Security system that detects atypical behavior

ABSTRACT

System and method that identify atypical behavior of a user. One embodiment of the system includes an eye tracker to perform tracking of a user&#39;s gaze while viewing items, an inward-facing head-mounted thermal camera to take thermal measurements of a region of interest on the face (TH ROI ) of the user, and a computer. The computer generates feature values based on TH ROI  and the tracking, and utilizes a model to identify atypical behavior of the user based on the feature values. The model may be trained based on previous tracking and previous TH ROI  of the user, taken while viewing other items.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to U.S. Provisional Patent ApplicationNo. 62/456,105, filed Feb. 7, 2017, and U.S. Provisional PatentApplication No. 62/480,496, filed Apr. 2, 2017, and U.S. ProvisionalPatent Application No. 62/566,572, filed Oct. 2, 2017. U.S. ProvisionalPatent Application No. 62/566,572 is herein incorporated by reference inits entirety.

This application is also a Continuation-In-Part of U.S. application Ser.No. 15/182,592, filed Jun. 14, 2016, which claims priority to U.S.Provisional Patent Application No. 62/175,319, filed Jun. 14, 2015, andU.S. Provisional Patent Application No. 62/202,808, filed Aug. 8, 2015.

This application is also a Continuation-In-Part of U.S. application Ser.No. 15/231,276, filed Aug. 8, 2016, which claims priority to U.S.Provisional Patent Application No. 62/202,808, filed Aug. 8, 2015, andU.S. Provisional Patent Application No. 62/236,868, filed Oct. 3, 2015.

This application is also a Continuation-In-Part of U.S. application Ser.No. 15/284,528, filed Oct. 3, 2016, which claims priority to U.S.Provisional Patent Application No. 62/236,868, filed Oct. 3, 2015, andU.S. Provisional Patent Application No. 62/354,833, filed Jun. 27, 2016,and U.S. Provisional Patent Application No. 62/372,063, filed Aug. 8,2016.

This application is also a Continuation-In-Part of U.S. application Ser.No. 15/635,178, filed Jun. 27, 2017, which claims priority to U.S.Provisional Patent Application No. 62/354,833, filed Jun. 27, 2016, andU.S. Provisional Patent Application No. 62/372,063, filed Aug. 8, 2016.

This application is also a Continuation-In-Part of U.S. application Ser.No. 15/722,434, filed Oct. 2, 2017, which claims priority to U.S.Provisional Patent Application No. 62/408,677, filed Oct. 14, 2016, andU.S. Provisional Patent Application No. 62/456,105, filed Feb. 7, 2017,and U.S. Provisional Patent Application No. 62/480,496, filed Apr. 2,2017. U.S. Ser. No. 15/722,434 is also a Continuation-In-Part of U.S.application Ser. No. 15/182,592, filed Jun. 14, 2016, which claimspriority to U.S. Provisional Patent Application No. 62/175,319, filedJun. 14, 2015, and U.S. Provisional Patent Application No. 62/202,808,filed Aug. 8, 2015. U.S. Ser. No. 15/722,434 is also aContinuation-In-Part of U.S. application Ser. No. 15/231,276, filed Aug.8, 2016, which claims priority to U.S. Provisional Patent ApplicationNo. 62/202,808, filed Aug. 8, 2015, and U.S. Provisional PatentApplication No. 62/236,868, filed Oct. 3, 2015, and U.S. Ser. No.15/722,434 is also a Continuation-In-Part of U.S. application Ser. No.15/284,528, filed Oct. 3, 2016, which claims priority to U.S.Provisional Patent Application No. 62/236,868, filed Oct. 3, 2015, andU.S. Provisional Patent Application No. 62/354,833, filed Jun. 27, 2016,and U.S. Provisional Patent Application No. 62/372,063, filed Aug. 8,2016.

ACKNOWLEDGMENTS

Gil Thieberger would like to thank his holy and beloved teacher, LamaDvora-hla, for her extraordinary teachings and manifestation of wisdom,love, compassion and morality, and for her endless efforts, support, andskills in guiding him and others on their paths to freedom and ultimatehappiness. Gil would also like to thank his beloved parents for raisinghim exactly as they did.

BACKGROUND

Large and heavy non head-mounted thermal cameras are used today tomeasure physiological features like blood flow, pulse rate, bloodvessels distribution, breathing rate, and to provide reliable cuesindicative of deception. Because controlling ones physiologicalresponses is difficult, facial thermal analysis can provide automaticdeception detection accuracies above 85%. Instantaneous stressconditions can be detected using thermal imaging based on identifying anincrease in the periorbital blood flow, and sustained stress conditionscan be detected using thermal imaging based on identifying elevatedblood flow in the forehead. However, none of the prior art techniquesare used on a daily basis to identify typical and atypical behaviors ofa user.

SUMMARY

Alertness, anxiety, and even fear are often experienced by peopleperpetrating illegal activities during their illicit actions. When auser experiences elevated feelings of alertness, anxiety, or fear,increased levels of adrenaline are secreted to regulate blood flow.Redistribution of blood flow in superficial blood vessels causes changesin local skin temperature that are apparent in the user's face. Thechanges to the blood flow are caused by the sympathetic system, and theyusually cannot be totally controlled; thus, they may constitute apowerful biometric that is difficult to conceal. This biometric canprovide valuable clues to security systems monitoring access to criticaland/or sensitive data about potential suspects who are often nottypically detected with identification biometrics, such as first timeoffenders.

People performing routine activities often tend to exhibit a certainphysiological response that characterizes their performance of theactivity. However, when something is very different about the activity,such as when it involves something illegal or dishonest, they mayexperience higher alertness, anxiety, and/or fear, which are oftendifficult to control or conceal. Thus, when a person knows that he orshe are doing something wrong, even if it concerns a seemingly routineaction for them, their physiological response may be a telltale.

Some aspects of this disclosure involve monitoring a user whileperforming his or her job in order to create a model of the user'stypical behavior. This monitoring may involve determining the typicalstress levels of the user and gaze patterns (e.g., what the usertypically pays attention too when performing the usual activities on thejob). When the user exhibits atypical behavior while performing a job,it may be an indication that something illicit and/or illegal is beingperformed. For example, a bank loan officer knowingly approving a faultyloan may exhibit higher stress levels while evaluating the loan formsand may also have a significantly different gaze pattern compared towhen working on a usual loan application. In another example, a doctorexamining a patient in order to assist in a faulty insurance claim mayalso be more stressed and/or have a different gaze pattern. Whenatypical behavior is detected, it can be noted in order to have theevent to which it corresponds inspected more thoroughly by other parties(e.g., a supervisor).

BRIEF DESCRIPTION OF THE DRAWINGS

The embodiments are herein described by way of example only, withreference to the following drawings:

FIG. 1a and FIG. 1b illustrate various inward-facing head-mountedcameras coupled to an eyeglasses frame;

FIG. 2 illustrates inward-facing head-mounted cameras coupled to anaugmented reality device;

FIG. 3 illustrates head-mounted cameras coupled to a virtual realitydevice;

FIG. 4 illustrates a side view of head-mounted cameras coupled to anaugmented reality device;

FIG. 5 illustrates a side view of head-mounted cameras coupled to asunglasses frame;

FIG. 6, FIG. 7, FIG. 8 and FIG. 9 illustrate head-mounted systems (HMSs)configured to measure various ROIs relevant to some of the embodimentsdescribes herein;

FIG. 10, FIG. 11, FIG. 12 and FIG. 13 illustrate various embodiments ofsystems that include inward-facing head-mounted cameras havingmulti-pixel sensors (FPA sensors);

FIG. 14a is a schematic illustration of an inward-facing head-mountedcamera embedded in an eyeglasses frame, which utilizes the Scheimpflugprinciple;

FIG. 14b is a schematic illustration of a camera that is able to changethe relative tilt between its lens and sensor planes according to theScheimpflug principle;

FIG. 15 illustrates an embodiment of an HMS able to measure stresslevel;

FIG. 16 illustrates examples of asymmetric locations of inward-facinghead-mounted thermal cameras (CAMs) that measure the periorbital areas;

FIG. 17 illustrates an example of symmetric locations of CAMs thatmeasure the periorbital areas;

FIG. 18 illustrates a scenario in which a system suggests to the user totake a break in order to reduce the stress level;

FIG. 19a illustrates a child watching a movie while wearing aneyeglasses frame with at least five CAMs;

FIG. 19b illustrates generation of a graph of the stress level of thechild detected at different times while different movie scenes wereviewed;

FIG. 20 illustrates an embodiment of a system that generates apersonalized model to detect stress based on thermal measurements of theface;

FIG. 21 illustrates an embodiment of a system that includes a userinterface, which notifies a user when the stress level of the userreaches a predetermined threshold;

FIG. 22 illustrates an embodiment of a system that selects a stressor;

FIG. 23 illustrates an embodiment of a system that detects an irregularphysiological response of a user while the user is exposed to sensitivedata;

FIG. 24 illustrates detection of an irregular physiological response;

FIG. 25 is a schematic illustration of a system that includes a frame,CAM, a computer, and an eye tracker;

FIG. 26 illustrates triggering an alert when the user moves the HMD andtouches the CAM;

FIG. 27 illustrates a scenario that identifies that a user is agitatedfrom viewing a video;

FIG. 28a and FIG. 28b illustrate scenarios in which stress levels andgaze patterns are utilized do detect atypical user behavior; and

FIG. 29a and FIG. 29b are schematic illustrations of possibleembodiments for computers.

DETAILED DESCRIPTION

A “thermal camera” refers herein to a non-contact device that measureselectromagnetic radiation having wavelengths longer than 2500 nanometer(nm) and does not touch its region of interest (ROI). A thermal cameramay include one sensing element (pixel), or multiple sensing elementsthat are also referred to herein as “sensing pixels”, “pixels”, and/orfocal-plane array (FPA). A thermal camera may be based on an uncooledthermal sensor, such as a thermopile sensor, a microbolometer sensor(where microbolometer refers to any type of a bolometer sensor and itsequivalents), a pyroelectric sensor, or a ferroelectric sensor.

Sentences in the form of “thermal measurements of an ROI” (usuallydenoted TH_(ROI) or some variant thereof) refer to at least one of: (i)temperature measurements of the ROI (T_(ROI)), such as when usingthermopile or microbolometer sensors, and (ii) temperature changemeasurements of the ROI (ΔT_(ROI)), such as when using a pyroelectricsensor or when deriving the temperature changes from temperaturemeasurements taken at different times by a thermopile sensor or amicrobolometer sensor.

In some embodiments, a device, such as a thermal camera, may bepositioned such that it occludes an ROI on the user's face, while inother embodiments, the device may be positioned such that it does notocclude the ROI. Sentences in the form of “the system/camera does notocclude the ROI” indicate that the ROI can be observed by a third personlocated in front of the user and looking at the ROI, such as illustratedby all the ROIs in FIG. 7 and FIG. 11. Sentences in the form of “thesystem/camera occludes the ROI” indicate that some of the ROIs cannot beobserved directly by that third person, such as ROIs 19 and 37 that areoccluded by the lenses in FIG. 1a , and ROIs 97 and 102 that areoccluded by cameras 91 and 96, respectively, in FIG. 9.

Although many of the disclosed embodiments can use occluding thermalcameras successfully, in certain scenarios, such as when using an HMS ona daily basis and/or in a normal day-to-day setting, using thermalcameras that do not occlude their ROIs on the face may provide one ormore advantages to the user, to the HMS, and/or to the thermal cameras,which may relate to one or more of the following: esthetics, betterventilation of the face, reduced weight, simplicity to wear, and reducedlikelihood to being tarnished.

A “Visible-light camera” refers to a non-contact device designed todetect at least some of the visible spectrum, such as a camera withoptical lenses and CMOS or CCD sensor.

The term “inward-facing head-mounted camera” refers to a cameraconfigured to be worn on a user's head and to remain pointed at its ROI,which is on the user's face, also when the user's head makes angular andlateral movements (such as movements with an angular velocity above 0.1rad/sec, above 0.5 rad/sec, and/or above 1 rad/sec). A head-mountedcamera (which may be inward-facing and/or outward-facing) may bephysically coupled to a frame worn on the user's head, may be attachedto eyeglass using a clip-on mechanism (configured to be attached to anddetached from the eyeglasses), or may be mounted to the user's headusing any other known device that keeps the camera in a fixed positionrelative to the user's head also when the head moves. Sentences in theform of “camera physically coupled to the frame” mean that the cameramoves with the frame, such as when the camera is fixed to (or integratedinto) the frame, or when the camera is fixed to (or integrated into) anelement that is physically coupled to the frame. The abbreviation “CAM”denotes “inward-facing head-mounted thermal camera”, the abbreviation“CAM_(out)” denotes “outward-facing head-mounted thermal camera”, theabbreviation “VCAM” denotes “inward-facing head-mounted visible-lightcamera”, and the abbreviation “VCAM_(out)” denotes “outward-facinghead-mounted visible-light camera”.

Sentences in the form of “a frame configured to be worn on a user'shead” or “a frame worn on a user's head” refer to a mechanical structurethat loads more than 50% of its weight on the user's head. For example,an eyeglasses frame may include two temples connected to two rimsconnected by a bridge; the frame in Oculus Rift™ includes the foamplaced on the user's face and the straps; and the frames in GoogleGlass™ and Spectacles by Snap Inc. are similar to eyeglasses frames.Additionally or alternatively, the frame may connect to, be affixedwithin, and/or be integrated with, a helmet (e.g., sports, motorcycle,bicycle, and/or combat helmets) and/or a brainwave-measuring headset.

When a thermal camera is inward-facing and head-mounted, challengesfaced by systems known in the art that are used to acquire thermalmeasurements, which include non-head-mounted thermal cameras, may besimplified and even eliminated with some of the embodiments describedherein. Some of these challenges may involve dealing with complicationscaused by movements of the user, image registration, ROI alignment,tracking based on hot spots or markers, and motion compensation in theIR domain.

In various embodiments, cameras are located close to a user's face, suchas at most 2 cm, 5 cm, 10 cm, 15 cm, or 20 cm from the face (herein “cm”denotes to centimeters). The distance from the face/head in sentencessuch as “a camera located less than 15 cm from the face/head” refers tothe shortest possible distance between the camera and the face/head. Thehead-mounted cameras used in various embodiments may be lightweight,such that each camera weighs below 10 g, 5 g, 1 g, and/or 0.5 g (herein“g” denotes to grams).

The following figures show various examples of HMSs equipped withhead-mounted cameras. FIG. 1a illustrates various inward-facinghead-mounted cameras coupled to an eyeglasses frame 15. Cameras 10 and12 measure regions 11 and 13 on the forehead, respectively. Cameras 18and 36 measure regions on the periorbital areas 19 and 37, respectively.The HMS further includes an optional computer 16, which may include aprocessor, memory, a battery and/or a communication module. FIG. 1billustrates a similar HMS in which inward-facing head-mounted cameras 48and 49 measure regions 41 and 41, respectively. Cameras 22 and 24measure regions 23 and 25, respectively. Camera 28 measures region 29.And cameras 26 and 43 measure regions 38 and 39, respectively.

FIG. 2 illustrates inward-facing head-mounted cameras coupled to anaugmented reality device such as Microsoft HoloLens™. FIG. 3 illustrateshead-mounted cameras coupled to a virtual reality device such asFacebook's Oculus Rift™. FIG. 4 is a side view illustration ofhead-mounted cameras coupled to an augmented reality device such asGoogle Glass™. FIG. 5 is another side view illustration of head-mountedcameras coupled to a sunglasses frame.

FIG. 6 to FIG. 9 illustrate HMSs configured to measure various ROIsrelevant to some of the embodiments describes herein. FIG. 6 illustratesa frame 35 that mounts inward-facing head-mounted cameras 30 and 31 thatmeasure regions 32 and 33 on the forehead, respectively. FIG. 7illustrates a frame 75 that mounts inward-facing head-mounted cameras 70and 71 that measure regions 72 and 73 on the forehead, respectively, andinward-facing head-mounted cameras 76 and 77 that measure regions 78 and79 on the upper lip, respectively. FIG. 8 illustrates a frame 84 thatmounts inward-facing head-mounted cameras 80 and 81 that measure regions82 and 83 on the sides of the nose, respectively. And FIG. 9 illustratesa frame 90 that includes (i) inward-facing head-mounted cameras 91 and92 that are mounted to protruding arms and measure regions 97 and 98 onthe forehead, respectively, (ii) inward-facing head-mounted cameras 95and 96, which are also mounted to protruding arms, which measure regions101 and 102 on the lower part of the face, respectively, and (iii)head-mounted cameras 93 and 94 that measure regions on the periorbitalareas 99 and 100, respectively.

FIG. 10 to FIG. 13 illustrate various inward-facing head-mounted camerashaving multi-pixel sensors (FPA sensors), configured to measure variousROIs relevant to some of the embodiments describes herein. FIG. 10illustrates head-mounted cameras 120 and 122 that measure regions 121and 123 on the forehead, respectively, and mounts head-mounted camera124 that measure region 125 on the nose. FIG. 11 illustrateshead-mounted cameras 126 and 128 that measure regions 127 and 129 on theupper lip, respectively, in addition to the head-mounted cameras alreadydescribed in FIG. 10. FIG. 12 illustrates head-mounted cameras 130 and132 that measure larger regions 131 and 133 on the upper lip and thesides of the nose, respectively. And FIG. 13 illustrates head-mountedcameras 134 and 137 that measure regions 135 and 138 on the right andleft cheeks and right and left sides of the mouth, respectively, inaddition to the head-mounted cameras already described in FIG. 12.

It is noted that the elliptic and other shapes of the ROIs in some ofthe drawings are just for illustration purposes, and the actual shapesof the ROIs are usually not as illustrated. It is possible to calculatethe accurate shape of an ROI using various methods, such as acomputerized simulation using a 3D model of the face and a model of ahead-mounted system (HMS) to which a thermal camera is physicallycoupled, or by placing a LED instead of the sensor (while maintainingthe same field of view) and observing the illumination pattern on theface. Furthermore, illustrations and discussions of a camera representone or more cameras, where each camera may have the same FOV and/ordifferent FOVs. Unless indicated to the contrary, the cameras mayinclude one or more sensing elements (pixels), even when multiplesensing elements do not explicitly appear in the figures; when a cameraincludes multiple sensing elements then the illustrated ROI usuallyrefers to the total ROI captured by the camera, which is made ofmultiple regions that are respectively captured by the different sensingelements. The positions of the cameras in the figures are just forillustration, and the cameras may be placed at other positions on theHMS.

Sentences in the form of an “ROI on an area”, such as ROI on theforehead or an ROI on the nose, refer to at least a portion of the area.Depending on the context, and especially when using a CAM having justone pixel or a small number of pixels, the ROI may cover another area(in addition to the area). For example, a sentence in the form of “anROI on the nose” may refer to either: 100% of the ROI is on the nose, orsome of the ROI is on the nose and some of the ROI is on the upper lip.

Various embodiments described herein involve detections of physiologicalresponses based on user measurements. Some examples of physiologicalresponses include stress, an allergic reaction, an asthma attack, astroke, dehydration, intoxication, or a headache (which includes amigraine). Other examples of physiological responses includemanifestations of fear, startle, sexual arousal, anxiety, joy, pain orguilt. Still other examples of physiological responses includephysiological signals such as a heart rate or a value of a respiratoryparameter of the user. Optionally, detecting a physiological responsemay involve one or more of the following: determining whether the userhas/had the physiological response, identifying an imminent attackassociated with the physiological response, and/or calculating theextent of the physiological response.

In some embodiments, detection of the physiological response is done byprocessing thermal measurements that fall within a certain window oftime that characterizes the physiological response. For example,depending on the physiological response, the window may be five secondslong, thirty seconds long, two minutes long, five minutes long, fifteenminutes long, or one hour long. Detecting the physiological response mayinvolve analysis of thermal measurements taken during multiple of theabove-described windows, such as measurements taken during differentdays. In some embodiments, a computer may receive a stream of thermalmeasurements, taken while the user wears an HMS with coupled thermalcameras during the day, and periodically evaluate measurements that fallwithin a sliding window of a certain size.

In some embodiments, models are generated based on measurements takenover long periods. Sentences of the form of “measurements taken duringdifferent days” or “measurements taken over more than a week” are notlimited to continuous measurements spanning the different days or overthe week, respectively. For example, “measurements taken over more thana week” may be taken by eyeglasses equipped with thermal cameras, whichare worn for more than a week, 8 hours a day. In this example, the useris not required to wear the eyeglasses while sleeping in order to takemeasurements over more than a week. Similarly, sentences of the form of“measurements taken over more than 5 days, at least 2 hours a day” referto a set comprising at least 10 measurements taken over 5 differentdays, where at least two measurements are taken each day at timesseparated by at least two hours.

Utilizing measurements taken of a long period (e.g., measurements takenon “different days”) may have an advantage, in some embodiments, ofcontributing to the generalizability of a trained model. Measurementstaken over the long period likely include measurements taken indifferent environments and/or measurements taken while the measured userwas in various physiological and/or mental states (e.g., before/aftermeals and/or while the measured user wassleepy/energetic/happy/depressed, etc.). Training a model on such datacan improve the performance of systems that utilize the model in thediverse settings often encountered in real-world use (as opposed tocontrolled laboratory-like settings). Additionally, taking themeasurements over the long period may have the advantage of enablingcollection of a large amount of training data that is required for somemachine learning approaches (e.g., “deep learning”).

Detecting the physiological response may involve performing varioustypes of calculations by a computer. Optionally, detecting thephysiological response may involve performing one or more of thefollowing operations: comparing thermal measurements to a threshold(when the threshold is reached that may be indicative of an occurrenceof the physiological response), comparing thermal measurements to areference time series, and/or by performing calculations that involve amodel trained using machine learning methods. Optionally, the thermalmeasurements upon which the one or more operations are performed aretaken during a window of time of a certain length, which may optionallydepend on the type of physiological response being detected. In oneexample, the window may be shorter than one or more of the followingdurations: five seconds, fifteen seconds, one minute, five minutes,thirty minute, one hour, four hours, one day, or one week. In anotherexample, the window may be longer than one or more of the aforementioneddurations. Thus, when measurements are taken over a long period, such asmeasurements taken over a period of more than a week, detection of thephysiological response at a certain time may be done based on a subsetof the measurements that falls within a certain window near the certaintime; the detection at the certain time does not necessarily involveutilizing all values collected throughout the long period.

In some embodiments, detecting the physiological response of a user mayinvolve utilizing baseline thermal measurement values, most of whichwere taken when the user was not experiencing the physiologicalresponse. Optionally, detecting the physiological response may rely onobserving a change to typical temperatures at one or more ROIs (thebaseline), where different users might have different typicaltemperatures at the ROIs (i.e., different baselines). Optionally,detecting the physiological response may rely on observing a change to abaseline level, which is determined based on previous measurements takenduring the preceding minutes and/or hours.

In some embodiments, detecting a physiological response involvesdetermining the extent of the physiological response, which may beexpressed in various ways that are indicative of the extent of thephysiological response, such as: (i) a binary value indicative ofwhether the user experienced, and/or is experiencing, the physiologicalresponse, (ii) a numerical value indicative of the magnitude of thephysiological response, (iii) a categorial value indicative of theseverity/extent of the physiological response, (iv) an expected changein thermal measurements of an ROI (denoted TH_(ROI) or some variationthereof), and/or (v) rate of change in TH_(ROI). Optionally, when thephysiological response corresponds to a physiological signal (e.g., aheart rate, a breathing rate, and an extent of frontal lobe brainactivity), the extent of the physiological response may be interpretedas the value of the physiological signal.

One approach for detecting a physiological response, which may beutilized in some embodiments, involves comparing thermal measurements ofone or more ROIs to a threshold. In these embodiments, the computer maydetect the physiological response by comparing the thermal measurements,and/or values derived therefrom (e.g., a statistic of the measurementsand/or a function of the measurements), to the threshold to determinewhether it is reached. Optionally, the threshold may include a thresholdin the time domain, a threshold in the frequency domain, an upperthreshold, and/or a lower threshold. When a threshold involves a certainchange to temperature, the certain change may be positive (increase intemperature) or negative (decrease in temperature). Differentphysiological responses described herein may involve different types ofthresholds, which may be an upper threshold (where reaching thethreshold means≥the threshold) or a lower threshold (where reaching thethreshold means≤the threshold); for example, each physiological responsemay involve at least a certain degree of heating, or at least a certaindegree cooling, at a certain ROI on the face.

Another approach for detecting a physiological response, which may beutilized in some embodiments, may be applicable when the thermalmeasurements of a user are treated as time series data. For example, thethermal measurements may include data indicative of temperatures at oneor more ROIs at different points of time during a certain period. Insome embodiments, the computer may compare thermal measurements(represented as a time series) to one or more reference time series thatcorrespond to periods of time in which the physiological responseoccurred. Additionally or alternatively, the computer may compare thethermal measurements to other reference time series corresponding totimes in which the physiological response did not occur. Optionally, ifthe similarity between the thermal measurements and a reference timeseries corresponding to a physiological response reaches a threshold,this is indicative of the fact that the thermal measurements correspondto a period of time during which the user had the physiologicalresponse. Optionally, if the similarity between the thermal measurementsand a reference time series that does not correspond to a physiologicalresponse reaches another threshold, this is indicative of the fact thatthe thermal measurements correspond to a period of time in which theuser did not have the physiological response. Time series analysis mayinvolve various forms of processing involving segmenting data, aligningdata, clustering, time warping, and various functions for determiningsimilarity between sequences of time series data. Some of the techniquesthat may be utilized in various embodiments are described in Ding, Hui,et al. “Querying and mining of time series data: experimental comparisonof representations and distance measures.” Proceedings of the VLDBEndowment 1.2 (2008): 1542-1552, and in Wang, Xiaoyue, et al.“Experimental comparison of representation methods and distance measuresfor time series data.” Data Mining and Knowledge Discovery 26.2 (2013):275-309.

Herein, “machine learning” methods refers to learning from examplesusing one or more approaches. Optionally, the approaches may beconsidered supervised, semi-supervised, and/or unsupervised methods.Examples of machine learning approaches include: decision tree learning,association rule learning, regression models, nearest neighborsclassifiers, artificial neural networks, deep learning, inductive logicprogramming, support vector machines, clustering, Bayesian networks,reinforcement learning, representation learning, similarity and metriclearning, sparse dictionary learning, genetic algorithms, rule-basedmachine learning, and/or learning classifier systems.

Herein, a “machine learning-based model” is a model trained usingmachine learning methods. For brevity's sake, at times, a “machinelearning-based model” may simply be called a “model”. Referring to amodel as being “machine learning-based” is intended to indicate that themodel is trained using machine learning methods (otherwise, “model” mayalso refer to a model generated by methods other than machine learning).

In some embodiments, which involve utilizing a machine learning-basedmodel, a computer is configured to detect the physiological response bygenerating feature values based on the thermal measurements (andpossibly other values), and/or based on values derived therefrom (e.g.,statistics of the measurements). The computer then utilizes the machinelearning-based model to calculate, based on the feature values, a valuethat is indicative of whether, and/or to what extent, the user isexperiencing (and/or is about to experience) the physiological response.Optionally, calculating said value is considered “detecting thephysiological response”. Optionally, the value calculated by thecomputer is indicative of the probability that the user has/had thephysiological response.

Herein, feature values may be considered input to a computer thatutilizes a model to perform the calculation of a value, such as thevalue indicative of the extent of the physiological response mentionedabove. It is to be noted that the terms “feature” and “feature value”may be used interchangeably when the context of their use is clear.However, a “feature” typically refers to a certain type of value, andrepresents a property, while “feature value” is the value of theproperty with a certain instance (sample). For example, a feature may betemperature at a certain ROI, while the feature value corresponding tothat feature may be 36.9° C. in one instance and 37.3° C. in anotherinstance.

In some embodiments, a machine learning-based model used to detect aphysiological response is trained based on data that includes samples.Each sample includes feature values and a label. The feature values mayinclude various types of values. At least some of the feature values ofa sample are generated based on measurements of a user taken during acertain period of time (e.g., thermal measurements taken during thecertain period of time). Optionally, some of the feature values may bebased on various other sources of information described herein. Thelabel is indicative of a physiological response of the usercorresponding to the certain period of time. Optionally, the label maybe indicative of whether the physiological response occurred during thecertain period and/or the extent of the physiological response duringthe certain period. Additionally or alternatively, the label may beindicative of how long the physiological response lasted. Labels ofsamples may be generated using various approaches, such as self-reportby users, annotation by experts that analyze the training data,automatic annotation by a computer that analyzes the training dataand/or analyzes additional data related to the training data, and/orutilizing additional sensors that provide data useful for generating thelabels. It is to be noted that herein when it is stated that a model istrained based on certain measurements (e.g., “a model trained based onTH_(ROI) taken on different days”), it means that the model was trainedon samples comprising feature values generated based on the certainmeasurements and labels corresponding to the certain measurements.Optionally, a label corresponding to a measurement is indicative of thephysiological response at the time the measurement was taken.

Various types of feature values may be generated based on thermalmeasurements. In one example, some feature values are indicative oftemperatures at certain ROIs. In another example, other feature valuesmay represent a temperature change at certain ROIs. The temperaturechanges may be with respect to a certain time and/or with respect to adifferent ROI. In order to better detect physiological responses thattake some time to manifest, in some embodiments, some feature values maydescribe temperatures (or temperature changes) at a certain ROI atdifferent points of time. Optionally, these feature values may includevarious functions and/or statistics of the thermal measurements such asminimum/maximum measurement values and/or average values during certainwindows of time.

It is to be noted that when it is stated that feature values aregenerated based on data comprising multiple sources, it means that foreach source, there is at least one feature value that is generated basedon that source (and possibly other data). For example, stating thatfeature values are generated from thermal measurements of first andsecond ROIs (TH_(ROI1) and TH_(ROI2), respectively) means that thefeature values may include a first feature value generated based onTH_(ROI1) and a second feature value generated based on TH_(ROI2).Optionally, a sample is considered generated based on measurements of auser (e.g., measurements comprising TH_(ROI1) and TH_(ROI2)) when itincludes feature values generated based on the measurements of the user.

In addition to feature values that are generated based on thermalmeasurements, in some embodiments, at least some feature values utilizedby a computer (e.g., to detect a physiological response or train a mode)may be generated based on additional sources of data that may affecttemperatures measured at various facial ROIs. Some examples of theadditional sources include: (i) measurements of the environment such astemperature, humidity level, noise level, elevation, air quality, a windspeed, precipitation, and infrared radiation; (ii) contextualinformation such as the time of day (e.g., to account for effects of thecircadian rhythm), day of month (e.g., to account for effects of thelunar rhythm), day in the year (e.g., to account for seasonal effects),and/or stage in a menstrual cycle; (iii) information about the userbeing measured such as sex, age, weight, height, and/or body build.Alternatively or additionally, at least some feature values may begenerated based on physiological signals of the user obtained by sensorsthat are not thermal cameras, such as a visible-light camera, aphotoplethysmogram (PPG) sensor, an electrocardiogram (ECG) sensor, anelectroencephalography (EEG) sensor, a galvanic skin response (GSR)sensor, or a thermistor.

The machine learning-based model used to detect a physiological responsemay be trained, in some embodiments, based on data collected inday-to-day, real world scenarios. As such, the data may be collected atdifferent times of the day, while users perform various activities, andin various environmental conditions. Utilizing such diverse trainingdata may enable a trained model to be more resilient to the variouseffects different conditions can have on the values of thermalmeasurements, and consequently, be able to achieve better detection ofthe physiological response in real world day-to-day scenarios.

Since real world day-to-day conditions are not the same all the time,sometimes detection of the physiological response may be hampered bywhat is referred to herein as “confounding factors”. A confoundingfactor can be a cause of warming and/or cooling of certain regions ofthe face, which is unrelated to a physiological response being detected,and as such, may reduce the accuracy of the detection of thephysiological response. Some examples of confounding factors include:(i) environmental phenomena such as direct sunlight, air conditioning,and/or wind; (ii) things that are on the user's face, which are nottypically there and/or do not characterize the faces of most users(e.g., cosmetics, ointments, sweat, hair, facial hair, skin blemishes,acne, inflammation, piercings, body paint, and food leftovers); (iii)physical activity that may affect the user's heart rate, bloodcirculation, and/or blood distribution (e.g., walking, running, jumping,and/or bending over); (iv) consumption of substances to which the bodyhas a physiological response that may involve changes to temperatures atvarious facial ROIs, such as various medications, alcohol, caffeine,tobacco, and/or certain types of food; and/or (v) disruptive facialmovements (e.g., frowning, talking, eating, drinking, sneezing, andcoughing).

Occurrences of confounding factors may not always be easily identifiedin thermal measurements. Thus, in some embodiments, systems mayincorporate measures designed to accommodate for the confoundingfactors. In some embodiments, these measures may involve generatingfeature values that are based on additional sensors, other than thethermal cameras. In some embodiments, these measures may involverefraining from detecting the physiological response, which should beinterpreted as refraining from providing an indication that the user hasthe physiological response. For example, if an occurrence of a certainconfounding factor is identified, such as strong directional sunlightthat heats one side of the face, the system may refrain from detectingthat the user had a stroke. In this example, the user may not be alertedeven though a temperature difference between symmetric ROIs on bothsides of the face reaches a threshold that, under other circumstances,would warrant alerting the user.

Training data used to train a model for detecting a physiologicalresponse may include, in some embodiments, a diverse set of samplescorresponding to various conditions, some of which involve occurrence ofconfounding factors (when there is no physiological response and/or whenthere is a physiological response). Having samples in which aconfounding factor occurs (e.g., the user is in direct sunlight ortouches the face) can lead to a model that is less susceptible towrongfully detect the physiological response (which may be considered anoccurrence of a false positive) in real world situations.

When a model is trained with training data comprising samples generatedfrom measurements of multiple users, the model may be considered ageneral model. When a model is trained with training data comprising atleast a certain proportion of samples generated from measurements of acertain user, and/or when the samples generated from the measurements ofthe certain user are associated with at least a certain proportion ofweight in the training data, the model may be considered a personalizedmodel for the certain user. Optionally, the personalized model for thecertain user provides better results for the certain user, compared to ageneral model that was not personalized for the certain user.Optionally, personalized model may be trained based on measurements ofthe certain user, which were taken while the certain user was indifferent situations; for example, train the model based on measurementstaken while the certain user had a headache/epilepsy/stress/angerattack, and while the certain user did not have said attack.Additionally or alternatively, the personalized model may be trainedbased on measurements of the certain user, which were taken over aduration long enough to span different situations; examples of such longenough durations may include: a week, a month, six months, a year, andthree years.

Training a model that is personalized for a certain user may requirecollecting a sufficient number of training samples that are generatedbased on measurements of the certain user. Thus, initially detecting thephysiological response with the certain user may be done utilizing ageneral model, which may be replaced by a personalized model for thecertain user, as a sufficiently large number of samples are generatedbased on measurements of the certain user. Another approach involvesgradually modifying a general model based on samples of the certain userin order to obtain the personalized model.

After a model is trained, the model may be provided for use by a systemthat detects the physiological response. Providing the model may involveperforming different operations. In one embodiment, providing the modelto the system involves forwarding the model to the system via a computernetwork and/or a shared computer storage medium (e.g., writing the modelto a memory that may be accessed by the system that detects thephysiological response). In another embodiment, providing the model tothe system involves storing the model in a location from which thesystem can retrieve the model, such as a database and/or cloud-basedstorage from which the system may retrieve the model. In still anotherembodiment, providing the model involves notifying the system regardingthe existence of the model and/or regarding an update to the model.Optionally, this notification includes information needed in order forthe system to obtain the model.

A model for detecting a physiological response may include differenttypes of parameters. Following are some examples of variouspossibilities for the model and the type of calculations that may beaccordingly performed by a computer in order to detect the physiologicalresponse: (a) the model comprises parameters of a decision tree.Optionally, the computer simulates a traversal along a path in thedecision tree, determining which branches to take based on the featurevalues. A value indicative of the physiological response may be obtainedat the leaf node and/or based on calculations involving values on nodesand/or edges along the path; (b) the model comprises parameters of aregression model (e.g., regression coefficients in a linear regressionmodel or a logistic regression model). Optionally, the computermultiplies the feature values (which may be considered a regressor) withthe parameters of the regression model in order to obtain the valueindicative of the physiological response; and/or (c) the model comprisesparameters of a neural network. For example, the parameters may includevalues defining at least the following: (i) an interconnection patternbetween different layers of neurons, (ii) weights of theinterconnections, and (iii) activation functions that convert eachneuron's weighted input to its output activation. Optionally, thecomputer provides the feature values as inputs to the neural network,computes the values of the various activation functions and propagatesvalues between layers, and obtains an output from the network, which isthe value indicative of the physiological response.

A user interface (UI) may be utilized, in some embodiments, to notifythe user and/or some other entity, such as a caregiver, about thephysiological response and/or present an alert responsive to anindication that the extent of the physiological response reaches athreshold. The UI may include a screen to display the notificationand/or alert, a speaker to play an audio notification, a tactile UI,and/or a vibrating UI. In some embodiments, “alerting” about aphysiological response of a user refers to informing about one or moreof the following: the occurrence of a physiological response that theuser does not usually have (e.g., a stroke, intoxication, and/ordehydration), an imminent physiological response (e.g., an allergicreaction, an epilepsy attack, and/or a migraine), and an extent of thephysiological response reaching a threshold (e.g., stress and/or angerreaching a predetermined level).

Some of the disclosed embodiments may be utilized to detect a stresslevel of a user based on thermal measurements of the user's face, suchas the periorbital areas (i.e., areas around the eyes). In oneembodiment, a system configured to detect a stress level includes a CAMand a computer. CAM takes thermal measurements of a region on aperiorbital area (TH_(ROI1)) of the user, and is located less than 10 cmfrom the user's head. The computer detects the stress level based onTH_(ROI1).

In one embodiment, in which the region is on the periorbital area of theright eye, the system further includes a second inward-facinghead-mounted thermal camera (CAM2), which is located less than 10 cmfrom the user's head and takes thermal measurements of a region on theperiorbital area of the left eye (TH_(ROI2)). Optionally, the computerdetects the stress level based on both TH_(ROI1) and TH_(ROI2).Optionally, CAM and CAM2 are located at least 0.5 cm to the right and tothe left of the vertical symmetry axis (which goes through the middle ofthe forehead and the middle of the nose), respectively. Optionally, eachof CAM and CAM2 weighs below 10 g and is based on a thermopile, amicrobolometer, or a pyroelectric sensor, which may be a focal-planearray sensor.

It is to be noted that while various embodiments may utilize a singleCAM, due to asymmetrical placement of blood vessels in the face, thermalemissions of faces of many people are asymmetric to a certain extent.That is, the pattern of thermal emission from the left side of the facemay be different (possibly even noticeably different) from the patternof thermal emission from the right side of the face. Thus, for example,the temperature changes at the periorbital areas, in response toexperiencing at least a certain level of stress, may be asymmetric forsome users. The fact that various embodiments described below mayinclude two (or more) CAMs that take measurements of ROIs coveringdifferent sides of the face (referred to as TH_(ROI1) and TH_(ROI2)) canenable the computer to account for the thermal asymmetry when detectingthe stress level.

In some cases, interferences (such as an external heat source, touchingone of the eyes, or an irritated eye) cause an asymmetric effect on theright and left periorbital areas. As a result, utilizing right and leftCAMs, which are located in different angles relative to the interferingsource, provides the computer additional data that can improve itsperformances. The following are some examples of various ways in whichthe computer may account for the asymmetry when detecting the stresslevel based on TH_(ROI1) and TH_(ROI2), which include measurements ofthe of regions on the periorbital areas of the right and left eyes ofthe user, respectively.

In one embodiment, when comparing TH_(ROI1) and TH_(ROI2) to thresholds,the computer may utilize different thresholds for TH_(ROI1) andTH_(ROI2), in order to determine whether the user experienced a certainlevel of stress. Optionally, the different thresholds may be learnedbased on previous TH_(ROI1) and TH_(ROI2), which were measured when theuser experienced the certain level of stress and/or suffered fromcertain interferences.

In another embodiment, the computer may utilize different reference timeseries to which TH_(ROI1) and TH_(ROI2) are compared in order todetermine whether the user experienced the certain level of stress.Optionally, accounting for the asymmetric manifestation of the stress isreflected in the fact that a reference time series to which TH_(ROI1) iscompared is different from a reference time series to which TH_(ROI2) iscompared.

In yet another embodiment, when the computer utilizes a model tocalculate a stress level based on feature values generated based onTH_(ROI1) and/or TH_(ROI2). Optionally, the feature values include: (i)at least first and second feature values generated based on TH_(ROI1)and TH_(ROI2), respectively; and/or (ii) a third feature valueindicative of the magnitude of a difference between TH_(ROI1) andTH_(ROI2). In this embodiment, the computer may provide differentresults for first and second events that involve the same average changein TH_(ROI1) and TH_(ROI2), but with different extents of asymmetrybetween TH_(ROI1) and TH_(ROI2), and/or different magnitudes ofinterferences on the right and left eyes.

In still another embodiment, the computer may utilize the fact thatasymmetric temperature changes occur when the user experiences stress inorder to distinguish between stress and other causes of temperaturechanges in the periorbital areas. For example, drinking a hot beverageor having a physical exercise may cause in some people a more symmetricwarming pattern to the periorbital areas than stress. Thus, if such amore symmetric warming pattern is observed, the computer may refrainfrom identifying the temperature changes as being stress-related.However, if the warming pattern is asymmetric and corresponds totemperature changes in the periorbital areas of the user when the userexperiences stress, then the computer may identify the changes in thetemperatures being stress-related.

The computer may employ different approaches when detecting the stresslevel based on TH_(ROI1) (and possibly other sources of data such asTH_(ROI2)). In one embodiment, the computer may compare TH_(ROI1) (andpossibly other data) to a threshold(s), which when reached wouldindicate a certain stress level. In another embodiment, the computer maygenerate feature values based on TH_(ROI1) and TH_(ROI2), and utilize amodel (also referred to as a “machine learning-based model”) tocalculate a value indicative of the stress level based on the featurevalues (calculating the value indicative of the stress level may beconsidered herein as “detecting the stress level”). At least some of thefeature values are generated based on TH_(ROI1). Optionally, at leastsome of the feature values may be generated based on other sources ofdata, such as TH_(ROI2) and/or TH_(ROI3) (described below). Optionally,the model was trained based on samples comprising feature valuesgenerated based on previous TH_(ROI1) (and possibly other data, asexplained below), and corresponding labels indicative of a stress levelof the user. Optionally, the data used to train the model includesprevious TH_(ROI1) taken while the user was under elevated stress, andother previous TH_(ROI1) taken while the user was not under elevatedstress. Optionally, “elevated stress” refers to a stress level thatreaches a certain threshold, where the value of the threshold is setaccording to a predetermined stress scale (examples of stress scales aregiven further below). Optionally, “elevated stress” refers to aphysiological state defined by certain threshold values of physiologicalsignals (e.g., pulse, breathing rate, and/or concentration of cortisolin the blood).

In a first embodiment, when the stress level exceeds a certain value,TH_(ROI1) reach a threshold, and when the stress level does not exceedthe certain value, TH_(ROI1) do not reach the threshold. Optionally, thestress level is proportional to the values of TH_(ROI1) (which arethermal measurements of the region on the periorbital area), such thatthe higher TH_(ROI1) and/or the higher the change to TH_(ROI1) (e.g.,with reference to a baseline), the higher the stress level.

In a second embodiment, the computer detects the stress level based on adifference between TH_(ROI1) and a baseline value determined based on aset of previous measurements taken by CAM. Optionally, most of themeasurements belonging to the set were taken while the user was notunder elevated stress.

In a third embodiment, the stress level is detected using a model andfeature values generated based on additional measurements (m_(conf)) ofthe user and/or of the environment in which the user was in whileTH_(ROI1) were taken. m_(conf) may be taken by sensor 461. Optionally,m_(conf) are indicative of an extent to which a confounding factoroccurred while TH_(ROI1) were taken. The following are some examples ofsources of information for m_(conf), which may be used to detect thestress level.

In a first example, m_(conf) are physiological signals such as a heartrate, heart rate variability, galvanic skin response, a respiratoryrate, and respiratory rate variability, which are taken using sensorssuch as PPG, ECG, EEG, GSR and/or a thermistor.

In a second example, m_(conf) represent an environmental conditionand/or a situation of the user that may be considered a confoundingfactor, such as an indication of whether the user touched at least oneof the eyes, an indication of whether the user is engaged in physicalactivity (and possibly the type and/or extent of the physical activity),temperature, humidity, IR radiation level, and a noise level.Optionally, the one or more values are obtained based on using anaccelerometer, a pedometer, a humidity sensor, a miniature radar (suchas low-power radar operating in the range between 30 GHz and 3,000 GHz),a miniature active electro-optics distance measurement device (such as aminiature Lidar), an anemometer, an acoustic sensor, and/or a lightmeter.

In a third example, m_(conf) represent properties describing the user,such as the user's age, gender, marital status, occupation, educationlevel, health conditions, and/or mental health issues that the user mayhave.

Stress may be thought of as the body's method of reacting to achallenge. Optionally, stress may be considered a physiological reactionto a stressor. Some examples of stressors include mental stressors thatmay include, but are not limited to, disturbing thoughts, discontentwith something, events, situations, individuals, comments, or anything auser may interpret as negative or threatening. Other examples ofstressors include physical stressors that may put strain on the body(e.g., very cold/hot temperatures, injury, chronic illness, or pain). Inone example, a (high) workload may be considered a stressor. The extentto which a user feels stressed is referred to herein as a “stress level”and being under a certain level of stress may be referred to herein as“experiencing a certain stress level”. Depending on the embodiment, astress level may be expressed via various types of values, such as abinary value (the user is “stressed” or “not stressed”, or the user isunder “elevated stress” or “not under elevated stress”), a categorialvalue (e.g., no stress/low stress/medium stress/high stress), and/or anumerical value (e.g., a value on a scale of 0 to 10). In someembodiments, a “stress level” may refer to a “fight or flight” reactionlevel.

Evaluation of stress typically involves determining an amount of stressa person may be feeling according to some standard scale. There arevarious approaches known in the literature that may be used for thistask. One approach involves identifying various situations the personmay be in, which are associated with certain predefined extents ofstress (which are empirically derived based on observations). Example ofpopular approaches include the Holmes and Rahe stress scale, thePerceived Stress Scale, and the Standard Stress Scale (SSS). A commontrait of many the various stress scales is that they require a manualevaluation of situations a user undergoes, and do not measure the actualphysiological effects of stress.

In some embodiments, the computer may receive an indication of a type ofstressor, and utilize the indication to detect the stress level.Optionally, the indication is indicative of a period and/or durationduring which the user was affected by the stressor. In one example, theindication is utilized to select a certain threshold value, which isappropriate for the type of stressor, and to which TH_(ROI1) may becompared in order to determine whether the user is experiencing acertain stress level. Optionally, the certain threshold is determinedbased on thermal measurements of the user when the user reacted to astressor of the indicated type. In another example, the indication isutilized to select a certain reference time series, which corresponds tothe type of stressor, and to which TH_(ROI1) may be compared in order todetermine whether the user is experiencing a certain stress level.Optionally, the certain time series is based on thermal measurements ofthe user taken when the user reacted to a stressor of the indicatedtype. In yet another example, the computer generates one or more featurevalues based on the indication, and the one or more feature values areutilized to detect the stress level using a model (in addition tofeature values generated based on TH_(ROI1)). In still another example,the computer may select a window of time based on the indication, whichcorresponds to the expected duration of stress induced by the type ofstressor indicated in the indication. In this example, in order todetect the stress level of the user, the computer evaluates thermalmeasurements from among TH_(ROI1) that were taken at a time that fallsin the window.

Additional CAMs may be utilized to detect the stress level. The thermalmeasurements of the additional CAMs, typically denoted TH_(ROI2) below,may be utilized to generate one or more of the feature values that areused along with the machine learning-based model to detect the stresslevel.

In one embodiment, the system includes a second inward-facinghead-mounted thermal camera (CAM2) that takes thermal measurements of anadditional ROI on the face (TH_(ROI2)), such as the forehead, the nose,and/or a region below the nostrils. The region below the nostrils referto one or more regions on the upper lip, the mouth, and/or air volumethrough which the exhale streams from the nose and/or mouth flow, andit's thermal measurements are indicative of the user's breathing.

Given TH_(ROI2), the computer may generate feature values based onTH_(ROI1) and TH_(ROI2) (and possibly other sources of data) andutilizes a model to detect the stress level based on the feature values.Optionally, the model was trained based on previous TH_(ROI1) andTH_(ROI2) taken while the user had at least two different stress levelsaccording to a predetermined stress scale. For example, a first set ofprevious TH_(ROI1) and TH_(ROI2) taken while the user was under elevatedstress, and a second set of previous TH_(ROI1) and TH_(ROI2) taken whilethe user was not under elevated stress.

In another embodiment, the system further includes second and third CAMsthat take thermal measurements of regions on the right and left cheeks,respectively. Optionally, the computer detects the stress level alsobased on the thermal measurements of the cheeks.

FIG. 15 illustrates one embodiment of an HMS able to measure stresslevel. The system includes a frame 51, CAMs (52, 53, 54), and a computer56. CAMs are physically coupled to the frame and take thermalmeasurements of ROIs on the periorbital areas. Because CAMs are locatedclose to their respective ROIs, they can be small, lightweight, and maybe placed in many potential locations having line of sight to theirrespective ROIs. The computer 56, which may by located on the HMS, wornby the user, and/or remote such as in the cloud, detects the stresslevel based on changes to temperature of the periorbital areas receivedfrom the CAMs.

Due to the asymmetry of blood vessels in human faces and differentshapes of human faces, having CAMs pointed at the right and leftperiorbital areas may enable a more accurate detection of physiologicalphenomena such as stress, and/or may enable detection of stress that isharder to detect based on measuring only a single periorbital area.

While FIG. 15 and FIG. 16 illustrate examples of asymmetric locations ofCAMs that measure the right periorbital area relative to the locationsof CAMs that measure the left periorbital area, FIG. 17 illustrates anexample of symmetric locations of the CAMs that measure the rightperiorbital area relative to the locations of the CAMs that measure theleft periorbital area. In some embodiments, using thermal measurementsfrom both symmetric and asymmetric located CAMs may improve the system'sadaptability to different faces having different proportions.

FIG. 19a and FIG. 19b illustrate one scenario of detecting a user'sstress level. FIG. 19a illustrates a child watching a movie whilewearing an eyeglasses frame 570 with at least five CAMs. FIG. 19billustrates the at least five CAMs 571, 572, 573, 574, and 575, whichmeasure the right and left periorbital areas, the nose, and the rightand left cheeks, respectively (the different ROIs are designated bydifferent patterns). The figure further illustrates how the systemproduces a graph of the stress level detected at different times whiledifferent movie scenes were viewed.

In one embodiment, the system may include a head-mounted display (HMD)that presents digital content to the user and does not prevent CAM frommeasuring the ROI. In another embodiment, the system may include an eyetracker to track the user's gaze, and an optical see through HMD thatoperates in cooperation with the following components: a visible-lightcamera that captures images of objects the user is looking at, and acomputer that matches the objects the user is looking at with thedetected stress levels. Optionally, the eye tracker is coupled to aframe worn by the user. In yet another embodiment, the system mayinclude a HMD that presents video comprising objects, and an eyetracker. The computer utilizes data generated by the eye tracker tomatch the objects the user is looking at with the detected stresslevels. It is to be noted that there may be a delay between beingaffected by a stressor and a manifestation of stress as a reaction, andthis delay may be taken into account when determining what objectscaused the user stress.

In one embodiment, the system further includes a user interface (UI),such as user interface 483 illustrated in FIG. 21, which notifies theuser when the stress level reaches a predetermined threshold.Optionally, the UI notifies the user by an audio indication, a visualindication, and/or a haptic notification. Optionally, the greater thechange to the temperature of the periorbital areas, the higher thedetected stress level, and the indication is proportional to the stresslevel. Optionally, the UI also provides the user with encouragement notto engage in certain behavior that causes stress, such as displayinganger, screaming, denigrating others, lying, and/or cheating. In oneexample, the encouragement may include evidence based on detected stresslevels of the user, which indicates that conducting in the certainbehavior increases stress. In another example, the encouragement mayinclude reminding the user that the certain behavior is against theuser's beliefs and/or the certain behavior is contrary to the user'sgoals, interests, and/or resolutions.

In one embodiment, a system configured to alert about stress includes atleast CAM1 and CAM2 located at least 0.5 cm to the right and to the leftof the vertical symmetry axis that divides the user's face,respectively. CAM1 and CAM2 take thermal measurements of regions on theperiorbital areas of the right and left eyes (TH_(ROI1) and TH_(ROI2),respectively) of the user. UI 483 provides an alert about a stress levelreaching a threshold. Optionally, the system includes a frame that isworn on the user's head, CAM1 and CAM2 are physically coupled to theframe, weighs below 10 g each, and located less than 15 cm from theuser's face. Optionally, the system includes a transmitter that may beused to transmit TH_(ROI1) and TH_(ROI2) to a computer that detects thestress level based on TH_(ROI1) and TH_(ROI2). Optionally, responsive todetecting a stress level that reaches a threshold, the computer commandsthe user interface to provide the alert. For example, the computer maysend a signal to a smartphone app, and/or to a software agent that hascontrol of the user interface, to provide the alert.

One embodiment of a method for alerting about stress includes at leastthe following steps: In Step 1, taking thermal measurements of regionson the periorbital areas of the right and left eyes (TH_(ROI1) andTH_(ROI2), respectively) of a user utilizing first and second CAMs wornon the user's head and located at least 0.5 cm to the right and to theleft of the vertical symmetry axis that divides the user's face,respectively. And in Step 2, alerting about a stress level that isdetected based on TH_(ROI1) and TH_(ROI2). Optionally, the alert aboutthe allergic reaction is provided as text, image, sound, and/or hapticfeedback.

Optionally, the method further includes generating feature values basedon TH_(ROI1) and TH_(ROI2), and using a model for detecting the stresslevel based on the feature values. The model was trained based onprevious TH_(ROI1) and TH_(ROI2) of the user, taken during differentdays, which include: a first set of measurements taken while the userhad a first stress level according to a predetermined stress scale, anda second set of measurements taken while the user had a second stresslevel according to the predetermined stress scale.

Optionally, the method further includes generating feature values basedon TH_(ROI1) and TH_(ROI2), and using a model for detecting the stresslevel based on the feature values. The model was trained based onprevious TH_(ROI1) and TH_(ROI2) of one or more users, taken duringdifferent days, which comprise: a first set of measurements taken whilethe one or more users had a first stress level according to apredetermined stress scale, and a second set of measurements taken whilethe one or more users had a second stress level according to thepredetermined stress scale.

The above steps of generating the feature values and utilizing the modelmay be performed multiple times throughout the period of the differentdays during which TH_(ROI1) and TH_(ROI2) were taken, each timeutilizing a subset of TH_(ROI1) and TH_(ROI2) taken during a differentwindow of a certain length. In these embodiments, the alerting in Step 2may be done at a certain time for which a certain stress level isdetected (which warrants an alert).

FIG. 18 illustrates a scenario in which a system (which measures theforehead, right and left periorbital areas, nose, and below thenostrils) suggests to the user to take a break in order to reduce thestress level of the user. The system may suggest the user to partake inat least one of the following activities when the stress level reaches afirst threshold: practice pranayama, physical exercise, listen tobrainwave entrainment, and listen to positive loving statements.Optionally, the computer suggests to the user to stop the activity whenthe stress level gets below a second threshold. Optionally, the systemshows the user video comprising objects, and the detected stress levelassociated with the objects.

FIG. 20 illustrates one embodiment of a system configured to generate apersonalized model for detecting stress based on thermal measurements ofthe face. The system includes a frame, first and second CAMs, and acomputer 470. The first and second CAMs take thermal measurements 471 ofregions on the periorbital areas of the right and left eyes (TH_(ROI1)and TH_(ROI2), respectively) of the user 472.

The computer 470 generates samples based on data comprising: (i)TH_(ROI1) and TH_(ROI2) 471, and (ii) indications 473 corresponding todifferent times, which are indicative of stress levels of the user atthe different times. Optionally, each sample comprises: (i) featurevalues generated values based on TH_(ROI1) and TH_(ROI2) taken during acertain period, and (ii) a label indicative of a stress level of theuser during the certain period. Optionally, at least one of the featurevalues in a sample may be generated based on other sources ofinformation such as physiological measurements of the user 472 and/ormeasurements of the environment in which the user 472 was in when whileTH_(ROI1) and TH_(ROI2) 471 were taken. Optionally, the stress levelsindicated in the indications 473 correspond to levels of a known stresslevel scale. The computer 470 trains a model 477 based on the samples.Optionally, the computer 470 also provides the model 477 to be used by asystem that detects stress based on TH_(ROI1) and TH_(RoI2).

The indications 473 may be generated in different ways, in differentembodiments. One or more of the indications 473 may be (i) generated byan entity that observes the user 472, such as a human observer or asoftware program (e.g., a software agent operating on behalf of the user472), (ii) provided by the user 472, such as via a smartphone app bypressing a certain button on a screen of a smartphone, and/or by speechthat is interpreted by a software agent and/or a program with speechanalysis capabilities, (iii) determined based on analysis of behavior ofthe user 472, such as by analyzing measurements of a camera and/or amicrophone that indicate that the user 472 is experiencing a certainstress level, and (iv) determined based on physiological signals of theuser 472 that are not thermal measurements of one or more ROIs on theface, such as measurements of the user's heart rate and/or brainwaveactivity.

Optional stress analysis module 497 receives descriptions of eventscorresponding to when at least some of TH_(ROI1) and TH_(ROI2) 471 weretaken, and generates one or more of the indications 473 based onanalyzing the descriptions. The stress analysis module 497 isimplemented by the computer 470 or another computer. Optionally, all ofthe indications 473 are generated by the stress analysis module 497.Optionally, the stress analysis module 497 may be a module of a softwareagent operating on behalf of the user 472. The descriptions received bythe stress analysis module 497 may include various forms of information.In one example, the descriptions include content of a communication ofthe user 472, and the stress analysis module 497 utilizes semanticanalysis in order to determine whether the communication is indicative astressful event for the user 472 (e.g., the communication is indicativeof something going wrong at work). Optionally, the stress analysismodule 497 utilizes a machine learning-based model to calculate based onfeatures derived from the communication, a predicted stress level forthe user 472. In another example, the stress analysis module 497receives images of an event, such as images taken by an outward-facinghead-mounted visible-light camera, utilizes image analysis to determinewhether the event corresponds to a stressful event, and utilizes amachine learning-based model to calculate the predicted stress based onfeatures derived from the images.

The model is trained on samples comprising feature values based onTH_(ROI1) and TH_(ROI2), and additional feature values described in thefollowing examples:

In a first example, the additional feature values include additionalthermal measurements, taken with another CAM, of an ROI that includesthe nasal and/or mouth regions.

In a second example, the additional feature values are indicative of oneor more of the following signals of the user 472: a heart rate, heartrate variability, brainwave activity, galvanic skin response, muscleactivity, and an extent of movement.

In a third example, the additional feature values are measurements(m_(conf) 474) of the user 472 and/or of the environment in which theuser 472 was in while TH_(ROI1) and TH_(ROI2) 471 were taken.Optionally, m_(conf) 474 are taken by a sensor 461, which may bephysically coupled to the frame. In another example, the sensor 461 iscoupled to a device carried by the user, such as a smartphone, asmartwatch, and/or smart clothing (e.g., clothing embedded with sensorsthat can measure the user and/or the environment). In yet anotherexample, the sensor 461 may be an external sensor that is not carried bythe user. Optionally, the computer 470 is generates, based on m_(conf)474, one or more feature values of at least some of the samples.m_(conf) 474 are indicative of an extent to which one or moreconfounding factors occurred while TH_(ROI1) and TH_(ROI2) 471 weretaken.

In one embodiment, the sensor 461 is a visible-light camera physicallycoupled to the frame, which takes images of a region on the face of theuser 472, which includes at least 25% of the ROI₁ and/or ROI₂.Optionally, the confounding factor in this embodiment involvesinflammation of the skin, skin blemishes, food residues on the face,talking, eating, drinking, and/or touching the face. In anotherembodiment, the sensor 461 includes a movement sensor that measures amovement of the user 472. Optionally, the confounding factor in thisembodiment involves the user 472 walking, running, exercising, bendingover, and/or getting up from a sitting or lying position. In yet anotherembodiment, the sensor 461 measures at least one of the followingenvironmental parameters: a temperature of the environment, a humiditylevel of the environment, a noise level of the environment, air qualityin the environment, a wind speed in the environment, an extent ofprecipitation in the environment, and an infrared radiation level in theenvironment.

In some embodiments, the samples used to train the model 477 includesamples that were generated based on TH_(ROI1) and TH_(ROI2) of the user472 taken while the user 472 had different stress levels. In oneembodiment, one or more samples that were generated based on TH_(ROI1)and TH_(ROI2) of the user 472 taken while a stress level of the user 472reached a threshold. Optionally, the stress level is evaluated using oneor more known stress level scales. Optionally, a user whose stress levelreaches the threshold is considered “stressed”. Additionally, in thisembodiment, the samples include one or more samples that were generatedbased TH_(ROI1) and TH_(ROI2) of the user 472, which were taken while astress level of the user 472 did not reach the threshold. Optionally, auser whose stress level does not reach the threshold is not considered“stressed”. Thus, the samples may be utilized to train a model that canhelp distinguish between cases in which TH_(ROI1) and TH_(ROI2) of theuser 472 are taken while the user 472 is stressed (and/or the user 472has a certain stress level), and cases in which TH_(ROI1) and TH_(ROI2)of the user 472 are taken while the user 472 is not stressed (and/or theuser 472 does not have a certain stress level).

The samples used to train the model 477 may include samples generatedbased on measurements taken while user 472 was in differentenvironments. In one example, the samples comprise first and secondsamples that are based on TH_(ROI1) and TH_(ROI2) of the user 472 takenduring first and second periods, respectively. Optionally, differentenvironmental conditions prevailed during the first and second periods,which involved one or more of the following differences: (i) thetemperature of the environment in which the user 472 was during thefirst period was at least 10° C. higher than the temperature of theenvironment in which the user 472 was during the second period; (ii) thehumidity level in the environment in which the user 472 was during thefirst period was at least 30% higher than the humidity level in theenvironment in which the user 472 was during the second period; and(iii) the user 472 was exposed to rain, hail, and/or snow during thefirst period and the user was not exposed to any of rain, hail, and snowduring the second period.

Additionally or alternatively, the samples utilized to train the model477 may include samples generated based on measurements taken while theuser 472 was in various situations. In one example, the samples comprisefirst and second samples that are based on TH_(ROI1) and TH_(ROI2) ofthe user 472 taken during first and second periods, respectively.Optionally, the user 472 was in different situations during the firstand second periods, which involved one or more of the followingdifferences: (i) the user 472 was sedentary during the first period,while the user 472 was walking, running, and/or biking during the secondperiod; and (ii) the user 472 was indoors during the first period, whilethe user 472 was outdoors during the second.

Additionally or alternatively, the samples utilized to train the model477 may be based on TH_(ROI1) and TH_(ROI2) taken during different daysand/or over a long period, such as more than a week, more than a month,or more than a year.

Training the model 477 may involve one or more of the variouscomputational approaches mentioned in this disclosure for training amodel used to detect a physiological response. In one example, trainingthe model 477 may involve selecting, based on the samples, a threshold;if a certain feature value reaches the threshold then a certain level ofstress of the user is detected. In another example, the computer 470utilizes a machine learning-based training algorithm to train the model477 based on the samples. Optionally, the model comprises parameters ofat least one of the following models: a regression model, a modelutilized by a neural network, a nearest neighbor model, a model for asupport vector machine for regression, and a model of a decision tree.

In some embodiments, the computer 470 may utilize deep learningalgorithms to train the model 477. In one example, the model 477 mayinclude parameters describing multiple hidden layers of a neuralnetwork. In one embodiment, when TH_(ROI1) and TH_(ROI2) includemeasurements of multiple pixels, such as when CAM includes a FPA, themodel 477 may include parameters of a convolution neural network (CNN).In one example, a CNN may be utilized to identify certain patterns inthe thermal images, such as patterns of temperatures on the foreheadthat may be indicative of a certain physiological response (e.g., aheadache, stress, or anger). In another embodiment, detecting the stresslevel may be done based on multiple, possibly successive, measurements.For example, stress may involve a progression of a state of the user(e.g., a gradual warming of certain areas of the forehead). In suchcases, detecting the stress level may involve retaining stateinformation that is based on previous measurements. Optionally, themodel 477 may include parameters that describe an architecture thatsupports such a capability. In one example, the model 477 may includeparameters of a recurrent neural network (RNN), which is a connectionistmodel that captures the dynamics of sequences of samples via cycles inthe network's nodes. This enables RNNs to retain a state that canrepresent information from an arbitrarily long context window. In oneexample, the RNN may be implemented using a long short-term memory(LSTM) architecture. In another example, the RNN may be implementedusing a bidirectional recurrent neural network architecture (BRNN).

In one embodiment, training the model 477 involves altering parametersof another model, which is generated based on TH_(ROI1) and TH_(ROI2) ofone or more other users. For example, the computer 470 may utilize theother model as an initial model. As the samples are acquired frommeasurements of the user 472, the computer 470 may update parameters ofthe initial model based on the samples. Thus, this process may beconsidered personalizing a general model according to measurements ofthe user 472.

Once the model 477 is generated, it may be utilized to detect stress ofthe user 472 based on other TH_(ROI1) and TH_(ROI2) of the user 472,which are not among TH_(ROI1) and TH_(ROI2) 471 that were used fortraining the model 477. Such utilization of the model 477 is illustratedin FIG. 21, which illustrates one embodiment of a system configured toperform personalized detection of stress based on thermal measurementsof the periorbital area. One embodiment of the illustrated systemincludes a frame 469, first and second CAMs, and a computer 476.

The computer 476 is configured to: generate feature values based onTH_(ROI1) and TH_(ROI2) 478 and utilize the model 477 to detect thestress level of the user 472 based on the feature values. Optionally,the model 477 was trained based on previous TH_(ROI1) and TH_(ROI2) ofthe user 472 (e.g., TH_(ROI1) and TH_(ROI2) 471), which were takenduring different days. The feature values generated based on TH_(ROI1)and TH_(ROI2) 478 are similar in their nature to the feature valuesgenerated based on TH_(ROI1) and TH_(ROI2) 471, which were discussed inmore detail above. Optionally, the computer 476 and the computer 470 mayutilize the same modules and/or procedures to generate feature valuesbased on TH_(ROI1) and TH_(ROI2) (and possibly other data). Optionally,the computer 476 receives measurements m_(conf) 474 indicative of anextent to which a confounding factor occurred while TH_(ROI1) andTH_(ROI2) 478 were taken, as discussed above.

Since the model 477 is personalized for the user 472, when such a modelis trained for different users, it may lead to different detections ofstress, even when provided with similar TH_(ROI1) and TH_(ROI2) of theusers. In one example, first and second models are generated based onprevious TH_(ROI1) and TH_(ROI2) of first and second different users,respectively. Responsive to utilizing the first model, a first value isdetected based on first feature values generated based on TH_(ROI1) andTH_(ROI2) of the first user, which is indicative of a first stresslevel. Responsive to utilizing the second model, a second value isdetected based on second feature values generated based on TH_(ROI1) andTH_(ROI2) of the second user, which is indicative of a second stresslevel. In this example, TH_(ROI1) and TH_(ROI2) of the first userindicate a greater temperature change at the periorbital areas of thefirst user compared to the change at the periorbital areas of the seconduser indicated by TH_(ROI1) and TH_(ROI2) of the second user. However,in this example, the first stress level is lower than the second stresslevel.

Some aspects of this disclosure involve monitoring a user over time withCAM that takes thermal measurements of a region on a periorbital area(TH_(ROI1)) of the user. One application for which TH_(ROI1) may beuseful is to detect the stress level of the user. Analysis of thesedetections combined with information regarding factors that affected theuser at different times, which may be considered potential stressors,can reveal which of the factors may be stressor that increase the stresslevel of the user.

Some examples of factors that may be considered potential stressors forcertain users include being in certain locations, interacting withcertain entities, partaking in certain activities, or being exposed tocertain content. Having knowledge of which potential stressor are likelyto actually be stressors for a certain user can help that user avoid thestressors and/or take early measures to alleviate the effects of thestress they cause.

FIG. 22 illustrates one embodiment of a system configured to select astressor. The system includes at least a computer 486 and CAM. Thesystem may optionally include a frame 469, a camera 383, and/or a UI495. In one example, CAM takes thermal measurements of the periorbitalarea of the right eye, and an additional CAM (CAM2) takes thermalmeasurements of a region on the periorbital area of the left eye(TH_(ROI2)) of the user.

In one embodiment, computer 486 calculates, based on the thermalmeasurements 487 (e.g., TH_(ROI1) and TH_(ROI2)), values that areindicative of stress levels of the user at different times (i.e., detectthe stress levels of the user at the different times). Optionally,TH_(ROI1) and TH_(ROI2) include thermal measurements taken while theuser had at least two different stress levels according to apredetermined stress scale. Optionally, the thermal measurements 487comprise thermal measurements taken during different days.

In some embodiments, the system that selects a stressor may includeadditional CAMs that take thermal measurements of one or more regions onthe user's forehead, nose, and/or below the nostrils. Optionally,thermal measurements taken by the additional CAMs are utilized by thecomputer 486 when calculating the user's stress level.

Furthermore, the computer 486 may receive indications 490 of factorsthat affected the user at various times, which may be consideredpotential stressors. The computer 486 also selects a stressor 491, fromamong the potential stressors, based on the indications 490 and thevalues that are indicative of stress levels of the user at differenttimes. Optionally, each of the indications 490 is indicative of a timeduring which the user was exposed to a potential stressor. Additionallyor alternatively, each of the indications 490 may be indicative of atime during which the user was affected by a potential stressor. In someembodiments, at any given time, the user may be exposed to more than oneof the potential stressors. Thus, in some embodiments, at least some ofthe thermal measurements 487, and optionally all of the thermalmeasurements 487, were taken while the user was exposed to two or morepotential stressors.

In one embodiment, the indications 490 include a list of periods of timeduring which various potential stressors affected the user. Optionally,the indications 490 are provided via a data structure and/or a queryablesystem that provides information for different points in time aboutwhich of the potential stressors affected the user at the points intime. There are various types of potential stressors that may beindicated by the indications 490.

In one embodiment, one or more of the potential stressors may relate tovarious locations the user was at (e.g., work, school, doctor's office,in-laws house, etc.) and/or to various activities the user partakes in(e.g., driving, public speaking, operating machinery, caring forchildren, choosing clothes to wear, etc.)

In another embodiment, one or more of the potential stressors may relateto entities with which the user interacts. For example, an entity may bea certain person, a person with a certain role (e.g., a teacher, apolice officer, a doctor, etc.), a certain software agent, and/or anavatar (representing a person or a software agent).

In yet another embodiment, one or more of the potential stressors mayrelate to situations in which the user is in, which can increase stress.For example, a situation may be being unemployed, having financialdifficulties, being separated after being in a relationship with anotherperson, being alone, or awaiting an important event (e.g., an exam, ajob interview, or results of an important medical test). In anotherexample, a situation may relate to a physical condition of the user,such as being sick or suffering from a certain chronic disease.Optionally, when the situations described above are applicable toanother person who the user cares about (e.g., a spouse, child, parent,or close friend), then those situations, which relate to the otherperson, may be considered potential stressors that can lead to stress inthe user.

In still another embodiment, one or more of the potential stressors mayrelate to the user's behavior. For example, behaving in a way that isargumentative, manipulative, deceptive, and/or untruthful may increasethe stress level.

When a user is affected by one or more potential stressors, in someembodiments, the stress level of the user may depend on quantitativeaspects of the potential stressors. In some examples, the degree towhich a potential stressor affects the user's stress level may depend onthe amount of time the potential stressor affected the user (e.g., theduration the user spent at a certain location) and/or the magnitude ofthe potential stressor (e.g., the extent to which an argument washeated—which may be expressed by the level of noise in peoplesshouting). In some embodiments, the indications 490 include values thatquantify how much at least some of the potential stressors affected theuser.

The stressor 491 is a potential stressor that is correlated with anincrease in the stress level of the user. Additionally, in someembodiments, the stressor 491 may be a potential stressor that may beconsidered a direct cause of the increase in the stress level of theuser. When considering how being affected by the potential stressorsrelates to the stress level of the user, an effect of the stressor 491is higher than effects of most of the potential stressors.

The effect of a potential stressor may be considered a measure of howmuch the potential stressor influences the stress level the user. Thiscan range from no influence to a profound influence. More specifically,in one embodiment, the effect of a potential stressor is a valueindicative of the average extent of change to the stress level of theuser at a time t+Δ after being affected by the potential stressor attime t. Here, Δ corresponds to the typical time it may take the stressto manifest itself in the user after being affected by the potentialstressor. This time may range from a short period e.g., several secondsor minutes, to hours.

There are various ways in which the computer 486 may select, based onthe indications 490 and the thermal measurements 487, the stressor 491from among the potential stressors being considered.

In some embodiments, the computer 486 performs a direct analysis of theeffect of each of the potential stressors in order to identify whichones have a large effect on the user. Optionally, the effect of eachpotential stressor is indicative of the extent to which it increases thestress level of the user. Optionally, the effect of each potentialstressor is calculated by determining, based on the indications 490,times at which the user was affected by the potential stressor, andobserving the stress level of the user at one or more times that are upto a certain period Δ later (where Δ depends on the user and the type ofstressor). In one example, Δ is ten seconds, thirty seconds, or oneminute. In another example, Δ is one minute, ten minutes, or one hour.

In one embodiment, a stress level (or change to the stress level)following being affected by a potential stressor is the maximum stresslevel that is detected from the time t the user was affected by thepotential stressor until the time t+Δ. In another example, the stresslevel (or change to the stress level) following being affected by thepotential stressor is the extent of the stress level and/or change tothe stress level that is detected at a time t+Δ (when the user wasaffected by the potential stressor at time t). Optionally, the extentmay be normalized based on a quantitative value representing how muchthe user was affected by the potential stressor. Optionally, the stresslevel may be normalized with respect to a stress level detected prior tobeing affected by the potential stressor.

Following a calculation of the effects of the potential stressors, inone embodiment, the computer 486 selects the stressor 491 from among thepotential stressors. Optionally, the stressor 491 is a potentialstressor that has a maximal effect (i.e., there is no other potentialstressor that has a higher effect). Optionally, the stressor 491 is apotential stressor that has an effect that reaches a threshold, whilethe effects of most of the potential stressors do not reach thethreshold.

In one embodiment, in order to increase confidence in the selection ofthe stressor, the stressor 491 is selected based on at least a certainnumber of times in which the user was affected by the stressor 491. Forexample, the certain number may be at least 3 or 10 different times.Thus, in this embodiment, potential stressors that did not affect theuser at least the certain number of times are not selected.

In some embodiments, the computer 486 generates a machine learning-basedmodel based on the indications 490 and the values indicative of thestress levels of the user, and selects the stressor 491 based on ananalysis of the model. Optionally, the computer 486 generates samplesused to train the model. The samples used to train the model maycorrespond to different times, with each sample corresponding to a timet+Δ including feature values and a label indicative of the stress levelof the user at the time t+Δ. Each sample may be considered to representa snapshot of potential stressors that affected the user during acertain period, and a label that is indicative of the stress level ofthe user following being affected by those potential stressors. Givenmultiple such samples, a machine learning training algorithm can beutilized to train a model for a predictor module that can predict thestress level at a certain time based on feature values that describepotential stressors that affected the user during a certain period oftime leading up to the certain time. For example, if the model is aregression model, the predictor module may perform a dot productmultiplication between a vector of regression coefficients (from themodel) and a vector of the feature values in order to calculate a valuecorresponding to the predicted stress level of the user at the certaintime.

When such a predictor module is capable of predicting stress level ofthe user based on the feature values described above, this may mean thatthe model captures, at least to some extent, the effects of at leastsome of the potential stressors on the stress level of the user.

Training the model based on the samples described above may involveutilizing one or more of various training algorithms. Some examples ofmodels that may be generated in order to be utilized by the predictormodule described above include the following models: a regression model(e.g., a regression model), a naïve Bayes model, a Bayes network, asupport vector machine for regression, a decision tree, and a neuralnetwork model, to name a few possibilities. There are various trainingalgorithms known in the art for generating these models and other modelswith similar properties.

The predictor module may be provided multiple inputs representing thepotential stressors that affected the user at different points of time,and have a capability to store state information of previous inputscorresponding to earlier times when it comes to predict the stress levelof the user at a certain time. For example, the predictor module may bebased on a recurrent neural network.

Once the model is trained, in some embodiments, it is analyzed by thecomputer 486 in order to determine the effects of one or more of thestressors on the stress level of the user. Depending on the type ofmodel that was trained, this analysis may be performed in differentways.

In one embodiment, the computer 486 performs the analysis of the modelby evaluating parameters of the model that correspond to the potentialstressors. Optionally, the computer 486 selects as the stressor 491 acertain potential stressor that has a corresponding parameter that isindicative of an effect that reaches a threshold while effects indicatedin parameters corresponding to most of the stressors do not reach thethreshold. In one example, the model may be a linear regression model inwhich each potential stressor corresponds to a regression variable. Inthis example, a magnitude of a value of a regression coefficient may beindicative of the extent of the effect of its corresponding potentialstressor. In another example, the model may be a naïve Bayes model inwhich various classes correspond to stress levels (e.g., a binaryclassification model that is used to classify a vector of feature valuesto classes corresponding to “stressed” vs. “not stressed”). In thisexample, each feature value may correspond to a potential stressor, andthe class conditional probabilities in the model are indicative of theeffect of each of the potential stressors on the user.

In another embodiment, the computer 486 performs an analysis of themodel, which may be characterized as “black box” analysis. In thisapproach, the predictor module is provided with various inputs thatcorrespond to different potential stressors that affect the user, andcalculates, based on the inputs and the model, various predicted stresslevels of the user. The various inputs can be used to independentlyand/or individually increase the extent to which each of the potentialstressors affects the user. This type of the model probing can helpidentify certain potential stressors that display an increase in thepredicted stress level, which corresponds to an increase in the extentto which the potential stressors affect the user (according to themodel). Optionally, the stressor 491 is a potential stressor for which apositive correlation is observed between increasing the extent to whichthe potential stressor affects that user, and the predicted stress levelof the user. Optionally, the stressor 491 is selected from among thepotential stressors, responsive to identifying that: (i) based on afirst subset of the various predicted stress levels of the user, aneffect of the stressor 491 reaches a threshold, and (ii) based on asecond subset of the various predicted stress levels of the user,effects of most of the potential stressors do not reach the threshold.

The indications 490 may be received from various sources. In oneembodiment, the user may provide at least some of the indications 490(e.g., by inputting data via an app and/or providing vocal annotationsthat are interpreted by a speech analysis software). In otherembodiments, at least some of the indications 490 are provided byanalysis of one or more sources of data. Optionally, the computer 486generates one or more of the indications 490 based on an analysis ofdata obtained from the one or more sources. The following four examples,discussed herein in relation to allergy, are also relevant as examplesof sources of data that may be utilized to identify potential stressorsthat affected the user at different times: (i) a camera 383 capturesimages of the surroundings of the user, (ii) sensors such asmicrophones, accelerometers, thermometers, pressure sensors, and/orbarometers may be used to identify potential stressors by identifyingwhat the user is doing and/or under what conditions, (iii) measurementsof the environment that user is in, and (iv) IoT devices, communicationsof the user, calendar, and/or billing information may provideinformation that may be used in some embodiments to identify potentialstressors.

Knowledge of the stressor 491 may be utilized for various purposes.Optionally, the knowledge of the stressor 491 is utilized by a softwareagent operating on behalf of the user in order to better serve the user.In some embodiments, information about the stressor 491 is provided tothe user via a UI 495, such as a smartphone, HMD, and/or an earphone).

UI 495 may be utilized on a day-to-day basis to warn the user when thestressor 491 is detected. For example, the computer 486 may providereal-time indications of potential stressors. Upon detecting that thosepotential stressors include the stressor 491, the UI notifies the userabout the stressor in order for the user to take action, such asreducing exposure to the stressor (e.g., by leaving a certain locationor ceasing a certain activity) and/or performing actions aimed atreducing stress (e.g., a breathing exercises).

In one embodiment, a software agent identifies that the user is going tobe affected by the stressor 491 (e.g., by analyzing the user's calendarschedule and/or communications), and suggests the user, via UI 495, toperform various exercises (e.g., breathing exercises) and/or preparehimself for the stressor 491 in order to reduce its effect.

With little modifications, the system illustrated in FIG. 22 may beutilized to detect a calming factor that reduces the user's stress,rather than one that increases it. In particular, instead of selecting astressor that has a large effect (or maximal effect) on the user, afactor that has a large negative effect on the stress level may beselected. Optionally, in the event that a high stress level of the useris detected, the calming factor may be suggested to the user (to reducethe user's stress level).

The following is a description of steps involved in one embodiment of amethod for selecting a stressor. The steps described below may be usedby systems modeled according to FIG. 22, and may be performed by runninga computer program having instructions for implementing the method.Optionally, the instructions may be stored on a computer-readablemedium, which may optionally be a non-transitory computer-readablemedium. In response to execution by a system including a processor andmemory, the instructions cause the system to perform operations of themethod. In one embodiment, the method for alerting about stress includesat least the following steps:

In Step 1, taking, utilizing a CAM, thermal measurements of a region ona periorbital area (TH_(ROI1)) of a user who wears CAM. Optionally, theregion on the periorbital area is a region of the periorbital area ofthe right eye, and this step also involves taking, utilizing a secondinward-facing head-mounted thermal camera (CAM2), thermal measurementsof a region on the periorbital area of the left eye (TH_(ROI2)).

In Step 2, detecting extents of stress based on TH_(ROI1). Optionally,detecting the extents may be done utilizing the computer, as discussedabove. Optionally, the extents are also detected based on TH_(ROI2)(and/or other thermal measurements mentioned below).

In Step 3, receiving indications of times during which the user wasexposed to potential stressors.

And in Step 4, selecting the stressor, from among the potentialstressors, based on the indications and the extents. Optionally, duringmost of the time the user was affected by the stressor, an effect of thestressor, as manifested via changes to TH_(ROI1), was higher thaneffects of most of the potential stressors.

In one embodiment, the method may optionally include a step of takingimages of the surroundings of the user and generating at least some ofthe indications based on analysis of the images. Optionally, the imagesare taken with the camera 383, as discussed above.

In one embodiment, selecting the stressor is done by generating amachine learning-based model based on the indications and extents, andselecting the stressor based on an analysis of the model. In oneexample, performing the analysis of the model involves evaluatingparameters of the model that correspond to the potential stressors. Inthis example, a certain potential stressor is selected as a stress. Thecertain potential stressor has a corresponding parameter in the modelthat is indicative of an effect that reaches a threshold, while effectsindicated in parameters corresponding to most of the other potentialstressors do not reach the threshold. In another example, performing theanalysis of the model involves: (i) providing a predictor module withvarious inputs that correspond to different potential stressors thataffect the user; (ii) calculating, based on the inputs and the model,various predicted stress levels; (iii) determining, based on the variouspredicted stress levels, effects of the potential stressors; and (iv)selecting the stressor based on the effects. In this example, the effectof the stressor reaches a threshold, while effects of most of the otherpotential stressors do not reach the threshold.

In one embodiment, a system configured to detect an irregularphysiological response of a user while the user is exposed to sensitivedata includes at least a head-mounted display (HMD), a CAM, and acomputer. Optionally, CAM is coupled to the HMD (e.g., they are bothcomponents of an HMS). The HMD exposes sensitive data to a user whowears the HMD. For example, the HMD may display text, images, and/orvideo. Optionally, the HMD may be a virtual reality display or anaugmented reality display. Optionally, the HMD is designed such thatonly the user who wears the HMD can view the sensitive data displayed onthe HMD. CAM takes thermal measurements of an ROI (TH_(ROI)) on theuser's face while the user is exposed to the sensitive data, and isoptionally located less than 15 cm from the face. In some embodiments,the system may include additional CAMs that take thermal measurements ofadditional ROIs on the user's face. In some embodiments, CAM may weighbelow 5 g and/or CAM may be located less than 5 cm from the user's face.

The computer detects, based on certain TH_(ROI) taken while the user isexposed to certain sensitive data, whether the user experienced theirregular physiological response while being exposed to the certainsensitive data.

In one embodiment, the certain TH_(ROI) are taken during a certainwindow of time that depends on the type of the irregular physiologicalresponse (e.g., a certain stress level and/or a certain emotionalresponse). Optionally, the window is at least five seconds long, atleast thirty seconds long, at least two minutes long, at least fiveminutes long, at least fifteen minutes long, at least one hour long, oris some other window that is longer than one second. Optionally, duringthe time the user is exposed to sensitive data, TH_(ROI) from multiplewindows may be evaluated (e.g., using a sliding window approach), whichinclude a window that contains a period during which the certainTH_(ROI) were taken.

In some embodiments, detecting the irregular physiological response isdone based on additional inputs such as thermal measurements taken byadditional CAMs (which may cover additional ROIs), and/or values ofphysiological signals and/or behavioral cues of the user such as heartrate, breathing rate, galvanic skin response, movements, facialexpressions, and/or brainwave activity. Optionally, the values ofphysiological signals and/or behavioral cues are obtained utilizingsensors other than CAMs.

What corresponds to an “irregular physiological response” may varybetween different embodiments. The following are some examples ofcriteria and/or ways of determining whether a physiological response isconsidered an “irregular physiological response”. In one example, theirregular physiological response involves the user experiencing stressthat reaches a certain threshold. Optionally, for most of the time theuser wears the HMD, the stress level detected for the user does notreach the certain threshold. In another example, the irregularphysiological response involves the user experiencing at least a certainlevel of one or more of the following emotions: anxiety, fear, andanger. Optionally, for most of the time the user wears the HMD, theextent to which the user experiences the one or more emotions does notreach the certain level. In yet another example, an irregularphysiological response corresponds to atypical measurement values. Forexample, if a probability density function is generated based onpreviously taken TH_(ROI) of the user, values with a low probability,such as a probability value that is lower than the probability of 97% ofthe previously taken TH_(ROI), may be considered atypical.

In order to detect the irregular physiological response, the computermay utilize TH_(ROI) in various ways, as described below. Optionally,detection of the irregular physiological response is done while takinginto account various factors that may influence the user's measuredphysiological responses, such as the user's emotional state (e.g.,whether the user is anxious, distraught, or calm), the environmentalconditions (e.g., the temperature, humidity level, and/or level ofoxygen in the air), and/or the type of sensitive data that the useraccesses.

In one embodiment, the computer compares one or more values derived fromthe certain TH_(ROI) to a certain threshold, and determines whether thethreshold is reached (which is indicative of an occurrence of theirregular physiological response). Optionally, the threshold isdetermined based on previously taken TH_(ROI) of the user (e.g., takenwhen the user had an irregular physiological response). Optionally, thethreshold is determined based on baseline thermal measurements of theuser, and the threshold represents a difference of a certain magnituderelative to the baseline measurements. Optionally, different thresholdsmay be utilized to detect different types of irregular physiologicalresponses, to detect irregular physiological responses to differenttypes of sensitive data, and/or to detect irregular physiologicalresponses when the user is in certain emotional states and/or undercertain environmental conditions.

In another embodiment, the computer generates feature values andutilizes a machine learning-based model to detect, based on the featurevalues, whether the user had an irregular physiological response. One ormore of the feature values are generated based on the certain TH_(ROI).Optionally, at least one of the feature values is generated based on thesensitive data, e.g., the at least one of the feature values maydescribe properties of the sensitive data. In one example, the model maybe generated based on previous TH_(ROI) of the user. In another example,the model may be generated based on previous TH_(ROI) of other users.

The emotional state of the user, while accessing the certain sensitivedata, may influence the user's physiological response, and thus may playa role in determining whether the user had an irregular physiologicalresponse. Similarly, the environmental conditions that prevail when theuser accesses the certain sensitive data, and also the type of sensitivedata being accessed, may influence the user's physiological response andthus may have a bearing on whether the user's physiological responseshould be considered irregular or not. Addressing these factors may bedone in different ways.

In one embodiment, multiple machine learning-based models may begenerated utilizing different training sets of data. For example,different models may be created to detect different types of irregularphysiological responses, to detect irregular physiological responses todifferent types of sensitive data, and/or to detect irregularphysiological responses when the user is in a certain emotional stateand/or under certain environmental conditions.

In another embodiment, the feature values generated by the computer mayinclude feature values that describe one or more of the followingfactors: an emotional state of the user while accessing the certainsensitive data, a condition of the environment in which the useraccessed the certain sensitive data, and the type of the certainsensitive data. Thus, the factors mentioned above may be considered whenthe determination is made regarding whether the user experienced anirregular physiological response. In one example, the computer receivesvalues indicative of the user's emotional state while being exposed tothe certain sensitive data, and utilizes a machine learning-based modelto detect whether the user experienced the irregular physiologicalresponse based on the certain TH_(ROI). Optionally, in this example, themachine learning-based model was trained based on previous TH_(ROI)taken while the user was in a similar emotional state. In anotherexample, the computer is receives values indicative of the environmentthe user was in while being exposed to the certain sensitive data (e.g.,temperature and/or humidity level), and utilizes a machinelearning-based model to detect whether the user experienced theirregular physiological response based on the certain TH_(ROI).Optionally, in this example, the machine learning-based model wastrained based on previous TH_(ROI) taken while the user was in a similarenvironment.

Determining what constitutes a certain type of sensitive data may bedone according to various criteria. In one example, different types ofsensitive data involve data with different classes of content (e.g.,intelligence reports vs. billing statements). In another example,different types of sensitive data involve data with different levels ofsensitivity (e.g., involve different levels of security clearance). Inyet another example, different types of sensitive data come fromdifferent sources. In another example, different types of sensitive datainvolve different types of media (e.g., text information vs. video). Instill another example, different types of sensitive data may correspondto the relationship of the sensitive data to the user (e.g., data thatinvolves someone close to the user vs. data that involves a stranger).

The following describes how the system may utilize information about thetype of sensitive data the user is exposed to in order to improve thedetection of an irregular physiological response during exposure to thatdata. In one example, certain sensitive data is associated with a firsttype of sensitive data, and the computer detects the irregularphysiological response when the certain TH_(ROI) reach a firstthreshold. Optionally, the first threshold is calculated based on otherTH_(ROI) taken while the user was exposed to sensitive data associatedwith the first type of sensitive data. Additionally, the user is exposedto second certain sensitive data, which is associated with a second typeof sensitive data. In this case, the computer detects the irregularphysiological response when second certain TH_(ROI) reach a secondthreshold. The second certain TH_(ROI) are taken while the user isexposed to the second certain sensitive data, the second threshold iscalculated based on other TH_(ROI) taken while the user was exposed tosensitive data associated with the second type of sensitive data. Inthis example, the second threshold is different from the firstthreshold.

In one embodiment, the sensitive data is associated with a type of datathat belongs to a set that includes at least first and second types ofsensitive data. The computer utilizes TH_(ROI) to generate featurevalues, and utilizes a model to calculate, based on the feature values,an extent of the irregular physiological response. Optionally, at leastone of the feature values indicates the type of sensitive data to whichthe user was exposed. Optionally, the model was trained based onprevious TH_(ROI) of one or more users and indications of the type ofsensitive data to which each of the one or more users was exposed.Optionally, the previous TH_(ROI) comprise at least some measurementstaken while the one or more users were exposed to the first type ofsensitive data and at least some measurements taken while the one ormore users were exposed to the second type of sensitive data.

Detecting the irregular physiological response may involve utilizationof one or more baselines. Optionally, a baseline may be indicative oftypical values for the user, such as typical thermal measurements whenexposed to sensitive data, the extent to which a user is typicallystressed when exposed to sensitive data, and/or the extent the usertypically expresses one or more of the following emotions when exposedto sensitive data: anxiety, fear, and anger. Optionally, a baseline maycorrespond to the user, i.e., it may represent expected values of theuser. Additionally or alternatively, a baseline may correspond tomultiple users, and represent expected values of other users (e.g., ageneral response).

In some embodiments, a baseline may be determined based on previousthermal measurements. In one example, the previous thermal measurementscomprise thermal measurements of the user. In another example, theprevious thermal measurements comprise thermal measurements of otherusers. Optionally, the previous thermal measurements are taken whilebeing exposed to baseline sensitive data. Optionally, the baselinesensitive data may be of the same type as the certain sensitive data.Optionally, the previous thermal measurements are taken with essentiallythe same system as the certain TH_(ROI) (e.g., the same headset or aheadset with a similar positioning of CAM).

In some embodiments, multiple baselines may be generated, correspondingto different types of sensitive data, different environmentalconditions, and/or different emotional states of the user. Optionally,the multiple baselines are each generated based on corresponding thermalmeasurements, such as thermal measurements taken while the person beingmeasured (e.g., the user or some other user) was exposed to a certaintype of sensitive data, in a certain type of environment, and/or whilein a certain emotional state.

In some cases, it may be useful to generate a baseline based onmeasurements taken in temporal proximity to when the user is exposed tothe certain sensitive data. Comparing close events may be beneficialbecause the shorter the time between being exposed to baseline sensitivedata and being exposed to the certain sensitive data, the smaller theeffect of environmental changes and/or normal physiological changes maybe. In one example, the user is exposed to the certain sensitive dataimmediately before and/or after being exposed to the baseline sensitivedata. In another example, the user is exposed to the certain sensitivedata within less than 5 minutes before and/or after being exposed to thebaseline sensitive data. In still another example, the user exposed tothe certain sensitive data within less than 15 minutes before or afterbeing exposed to the baseline sensitive data.

In some embodiments, a baseline may be calculated utilizing a predictor,which receives input comprising feature values describing various valuessuch as characteristics of user (e.g., age, gender, weight, occupation),the sensitive data, the environment in which the user is in, and/or theemotional state of the user. The predictor utilizes a machinelearning-based model to calculate, based on the feature values, thebaseline which may be, for example, a value of thermal measurements, astress level, or an extent of expressing a certain emotion. Optionally,the model was trained based on measurements of the user. Optionally, themodel was trained based on measurements of other users.

Baseline values may be utilized by the computer in various ways. Forexample, thermal measurements may be normalized with respect to abaseline in order to help identify when the thermal measurements deviatefrom the expected values (which may be indicative of the irregularphysiological response). In another example, a threshold to which thecomputer compares the certain TH_(ROI) may be a value that is definedrelative to the baseline. In yet another example, a reference timeseries may be selected based on a corresponding baseline (i.e., areference time series may correspond to an irregular physiologicalresponse that occurs when the user is in a certain baseline state). Instill another example, one or more feature values utilized to detect aphysiological response may be generated based on a baseline value (i.e.,the baseline may be one of the inputs for detecting the physiologicalresponse).

In one embodiment, TH_(ROI) express temperature at the ROI, and thebaseline expresses ordinary temperature at the ROI while the user isexposed to sensitive data. In another embodiment, TH_(ROI) expresstemperature change at the ROI, and the baseline expresses ordinarytemperature changes at the ROI around the time of switching from beingexposed to non-sensitive data to being exposed to sensitive data. Instill another embodiment, TH_(ROI) express temperature change at theROI, and the baseline expresses ordinary temperature changes at the ROIaround the time of switching from being exposed to sensitive data tobeing exposed to non-sensitive data.

It is noted that when the user is exposed to data over a period of time,in some embodiments, each segment of data (e.g., data watched during acertain span of a few minutes) may serve both as a baseline sensitivedata and/or as the certain sensitive data.

In one embodiment, the certain sensitive data is associated with a firsttype of sensitive data, and the computer detects the irregularphysiological response when a difference between the certain TH_(ROI)and a first baseline reaches a first threshold. Optionally, the firstbaseline is calculated based on other TH_(ROI) taken while the user wasexposed to sensitive data associated with the first type of sensitivedata. Additionally, the user is exposed to a second certain sensitivedata that is associated with a second type of sensitive data, and thecomputer detects the irregular physiological response while beingexposed to the second certain sensitive data when a difference betweensecond certain TH_(ROI) and a second baseline reaches a secondthreshold. Here, the second certain TH_(ROI) are taken while the user isexposed to the second certain sensitive data, the second baseline iscalculated based on other TH_(ROI) taken while the user was exposed tosensitive data associated with the second type of sensitive data. Inthis embodiment, the second threshold is different from the firstthreshold. Optionally, the system estimates job burnout; the greater thedifferences between TH_(ROI) and their associated baselines, the worseis the job burnout.

In different embodiments of the system configured to detect an irregularphysiological response of a user while the user is exposed to sensitivedata, the ROI may comprise different regions of the face and/or thesystem may involve various hardware configurations (e.g., certain typesof CAMs and/or additional CAMs). Optionally, measurements taken by anadditional CAM are utilized to generate one or more of the featurevalues utilized by the computer to detect the irregular physiologicalresponse.

In one embodiment, the ROI is on periorbital area of the user and CAMincludes an uncooled thermal sensor. Optionally, the ROI is on theperiorbital area of the right eye, and the system includes a second CAMthat takes thermal measurements of a region on the periorbital area ofthe left eye. Optionally, the computer detects the irregularphysiological response based on the measurements of the periorbitalareas of the right and left eyes.

In another embodiment, the ROI is on the user's nose and CAM includes anuncooled thermal sensor. Optionally, the ROI is on the right side of theuser's nose and the system includes a second CAM that takes thermalmeasurements of a region on the left side of the nose. Optionally, thecomputer detects the irregular physiological response based on themeasurements of the regions on the left and right sides of the nose.

In yet another embodiment, the ROI is on the user's forehead.Optionally, the ROI is on the right side of the user's forehead, and thesystem includes a second CAM that takes thermal measurements of the leftside of the user's forehead. Optionally, the computer detects theirregular physiological response based on the measurements of theregions on the left and right sides of the forehead.

FIG. 23 illustrates one embodiment of a system configured to detect anirregular physiological response of a user while the user is exposed tosensitive data. The system includes head-mounted system HMS 610, whichincludes a head-mounted display (HMD) for exposing the user to sensitivedata (not depicted in the figure) and six CAMs coupled to the frame ofthe HMS 610, which are 611 and 612 on the bottom of the frame to measurethe upper lip and nose, 613 and 614 inside the HMS to measure theperiorbital areas, and 615 and 616 on the top of the frame to measurethe forehead (the measured regions on the face are illustrated as shadedareas). It is to be noted that though the user's eyes are visible in thefigure, the front of the HMS may be opaque as is common with virtualreality headsets.

FIG. 24 illustrates detection of an irregular physiological response.The figure depicts a graph displaying temperatures at the right and leftperiorbital areas (lines 618 and 619 in the figure). The user is exposedto three documents via a HMD, “doc A”, “doc B”, and “doc C”. With thefirst two documents (“doc A” and “doc B”), the temperatures remain low,but when the user is exposed to “doc C” the temperature risesdramatically, which in this exemplary figure may constitute an irregularphysiological response.

In order to avoid detection of an irregular physiological response, auser exposed to sensitive data via the HMD may attempt to take evasivemeasures such as touching the face, moving the HMD, and/or occluding thesensors (e.g., in order to disrupt sensor measurements). An example ofsuch behavior is illustrated in FIG. 26 in which the user moves the HMDa bit and touches a CAM, which triggers an alert.

In one embodiment, the system may detect whether the user moves the HMDrelative to the face while being exposed to the certain sensitive data,based on measurements of an additional sensor (e.g., a sensor thatmeasures a confounding factor). Optionally, the computer takes one ormore security-related measures responsive to detecting that the usermoved the HMD relative to the face while being exposed to the certainsensitive data. Optionally, the system identifies moving the HMDrelative to the face based on one or more of the following: (i) analysisof images taken by an optical sensor physically coupled to the HMD, suchas a CAM, an active near-IR camera physically coupled to the HMD, and/ora visible-light camera physically coupled to the HMD, (ii) analysis ofimages taken by an optical sensor that captures the user's face withoutbeing physically coupled to the HMD, such as a 2D or a 3D camera locatedin a position that faces the user or located on a smartwatch or asmart-shirt, and/or (iii) analysis of measurements of a non-opticalsensor physically coupled to the HMD, such as a movement sensor, aminiature radar operating in the Extremely High Frequency (EHF) band, anacoustic sensor, an electroencephalogram sensor, an electromyogramsensor, a piezoelectric sensor, and/or strain gauges, as mentioned forexample in the reference Li, Hao, et al. “Facial performance sensinghead-mounted display” ACM Transactions on Graphics 2015, and (iv)analysis of measurements of a non-optical sensor physically coupled tothe user's body, such as a movement sensor embedded in a wrist band orembedded in a smart-shirt.

It is noted that sentences such as “while being exposed to the certainsensitive data” does not include removing the HMD off the face, becauseafter removing the HMD off the face the user is not exposed to thecertain sensitive data. In one example, moving the HMD relative to theface refers to a relative movement above a minimum threshold (e.g.,moving the frame to a distance that is greater than 1 cm). In anotherexample, making facial expressions does not cause the system to detectthat the user is moving the HMD relative to the face.

Some non-limiting examples of the security-related measures that thesystem may take include performing one or more of the following: storingin a database an indication that the user made a suspicious action (likemoving the HMD relative to the face while being exposed to the certainsensitive data at a certain point in time), ceasing from exposing theuser to the certain sensitive data, not allowing the user to perform acertain transaction related to the certain sensitive data, blocking theuser's access to the certain sensitive data, issuing an alert, markingas suspicious the relationship between the user and the certainsensitive data, tightening the security restrictions for the user foraccessing sensitive data on the system, providing the user a canarytrap, and providing the user a barium meal test.

A “canary trap” refers to a practice of providing the user with aversion of the sensitive data that contains certain indicators (e.g.,small variations) that are unique to the version provided to the user.Thus, if the sensitive data is leaked, the user may be identified as thesource based on detecting the small variations in the leaked data. A“barium meal test” refers to a practice of including in the sensitivedata certain information; when the certain information reaches an entityit causes the entity to take a certain action (e.g., visit a certainwebsite it would not ordinarily visit). Thus, detecting the certainaction is indicative of the sensitive data (to which the user wasexposed) being passed on to the entity.

In another embodiment, the system includes a sensor that providesmeasurements indicative of times at which the user touches the ROI.Optionally, touching the ROI is expected to influence TH_(ROI) and/ordisrupt the ability to detect the irregular physiological response. Theuser may touch the ROI using a finger, the palm, a tissue or a towelheld by the user, a makeup-related item held by the user, a materialthat is expected to cool the ROI (such as a metal that is colder thanthe skin), and/or a material that is transparent in the visible spectrum(such as a transparent glass that is colder than the skin). Optionally,responsive to detecting that the user touched the ROI while beingexposed to the certain sensitive data, the computer stores in a databasean indication thereof, and/or the system may perform at least one of theaforementioned security-related measures.

In yet another embodiment, the system detects occlusion of CAM based onidentifying a sudden change of more than 2° C. in TH_(ROI) and/orutilizing a sensor that generates a signal indicative of whether a solidobject is located between CAM and the ROI. Optionally, responsive todetecting that the user occluded CAM while being exposed to the certainsensitive data, the computer stores in a database an indication thereofand/or the system may perform at least one of the aforementionedsecurity-related measures.

In one embodiment, the computer tightens security restrictions for theuser responsive to detecting multiple occurrences possibly evasivemeasures such as touching the ROI, moving the HMD, and/or occluding theROI. Optionally, the multiple occurrences are detected while the user isexposed to sensitive data that is of the same type as the certainsensitive data. Optionally, tightening security restrictions for theuser involves restricting the user from performing a certain transactionrelated to the sensitive data. In one example, the certain transactioncomprises copying, reading, and/or modifying the certain sensitive data.In another example, the certain sensitive data relates to money, and thecertain transaction comprises an electronic funds transfer from oneperson or entity to another person or entity.

In some embodiments, responsive to a detection of the irregularphysiological response, the system initiates a process to detect anillegal activity. Optionally, the process is initiated within less thantwo minutes after detecting the irregular physiological response.Optionally, the sensitive data belongs to an organization, the user isan employee of the organization, and the system helps in preventingillegal activities of employees related to sensitive data.

Some embodiments of the system configured to detect an irregularphysiological response while being exposed to sensitive data includeadded security measures such as encryption of the sensitive data.Optionally, the system receives the certain sensitive data in anencrypted form, and the computer decrypts the certain sensitive databefore presentation via the HMD. The decryption may involvehardware-based decryption, requesting a password from the user, and/ormeasuring the user with a sensor (e.g., an iris scan), and/ormulti-factor authentication.

Another security measure that may be included in some embodiments of thesystem involves biometric identification of the user. In theseembodiments, the system may include a biometric identification device,which is physically coupled to the HMD, and identifies the user whilethe user wears the HMD. Optionally, the computer exposes the user to thesensitive data responsive to receiving an indication that confirms theuser's identity. Optionally, the biometric identification deviceperforms one or more of the following operations: an iris scan,detection of brainwave patterns, detection of a cardiac activitypattern, and detection of thermal patterns on the user's face.Optionally, the biometric identification device performs afingerprint-based identification of the user.

In one embodiment, a system that identifies whether a visual content(such as a video) includes an item that agitates a user includes an eyetracker, CAM, and a computer. The system may optionally include othercomponents, such as a frame that is worn on the user's head (to whichCAM, the eye tracker, and/or other components may be physicallycoupled). Additionally, the system may optionally include one or moreadditional CAMs and one or more sensors (which are not CAMs). The systemmay also include a head-mounted display (HMD) to display video to theuser. FIG. 25 is a schematic illustration of such a system that includesframe 620 with CAM coupled to it, a computer 624, and an eye tracker622.

CAM takes thermal measurements of an ROI (TH_(ROI)) on the user's face.Optionally, CAM is located less than 15 cm from the user's face.Optionally, CAM weighs less than 10 g. The ROI exhibits a change intemperature when the user experiences stress, such as the periorbitalareas around the eyes, the nose, and/or the forehead.

In one embodiment, TH_(ROI) are taken during a window of time that lastsbetween a second to a few minutes during which the user views a visualcontent that depicts items. Optionally, the window is at least fiveseconds long, at least thirty seconds long, at least two minutes long,at least five minutes long, at least fifteen minutes long, at least onehour long, or is some other window that is longer than one second.Optionally, during the time the user is exposed to the visual content,TH_(ROI) from multiple windows may be evaluated (e.g., using a slidingwindow approach).

The eye tracker tracks the user's gaze while watching the video thatdepicts items. Optionally, the user's gaze is indicative of attentionthe user paid to the items. Optionally, data generated by the eyetracker is indicative of attention the user paid to each of the items.The eye tracker may be head-mounted or non-head-mounted.

The data generated by the eye tracker describes the gaze of the user.For example, the data may be indicative of the coordinates, on a displaydisplaying the visual content (e.g., video), on which the user focusedduring various times while watching the video. Optionally, thecoordinates represent certain pixels and/or sets of pixels. Thisinformation may be analyzed along with information that describes theboundaries (e.g., coordinates) of the items in the video at differenttimes during its presentation in order to determine when the userfocuses on each item. Optionally, determining which items were presentedin the video may involve utilizing various image processing algorithms,which can identify items (e.g., objects and/or people) in the videoand/or define the boundaries of the items in the video at various times.Thus, using the data generated by the eye tracker, attention levels ofthe user in at least some of the items can be determined (e.g., by thecomputer). In one example, an attention level of the user in an item isindicative of the amount of time the user spent focusing on the item(e.g., before moving to another item). In another example, the attentionlevel of the user in an item is indicative of the number of times theuser's sight was focused on the item during certain duration. In stillanother example, the attention level of the user is a relative value,which indicates whether the user paid more attention or less attentionto the item compared to the other items in the video.

The computer is configured, in some embodiments, to detect, based onTH_(ROI) taken while the user views the video, a stress level of theuser. Additionally, the computer is configured to calculate an extent ofdiscordance between the attention the user paid to the items andexpected attention levels in the items. These two values (the stresslevel and extent of discordance) are utilized by the computer todetermine whether at least one of the items agitated the user. In oneembodiment, if the stress level reaches a first threshold and the extentof discordance reaches a second threshold, the computer makes adetermination that at least one of the items in the video agitated theuser. In another embodiment, the computer calculates, based on thestress level and the extent of discordance, a value indicative of aprobability that the items include an item that agitates the user.Optionally, if the value indicates a probability above a thirdthreshold, the computer makes a determination that at least one of theitems in the video agitated the user.

The value indicative of the probability that the items include an itemthat agitates the user is, in some embodiments, proportional to aproduct of the stress level and the extent of the discordance. That is,in most scenarios, the larger one or both of these values (the stresslevel and the extent of the discordance), the larger probability thatthe items include an item that agitates the user. In one example, thevalue is indicative of negative feelings related to an item and/or asituation presented in the video (the larger the value the likelier itis that the user harbors such negative feelings). In another example,the value is indicative of an extent to which it is likely that the useris concealing something related to the content of the video.

In one embodiment, the computer may utilize the stress levels and theinformation of the user's gaze to select the item, from among the itemsdepicted in the video, which agitates the user. Optionally, agitationdue to the item may be manifested by an increase of at least a certainlevel in the stress of the user and/or by the user having an atypicalgaze pattern in which the user pays significantly less attention orsignificantly more attention to the item than expected. In one example,“significantly more attention” refers to staring at the item at leastdouble the expected time, and “significantly less attention” refers tostaring at the item less than half the expected time.

The expected attention levels in the items may be based, in someembodiments, on tracking gazes during previous viewings of the videoand/or previous viewings of similar videos in order to determineattention in the items. In one embodiment, the attention levels in theitems are based on attention levels detected when the same video wasviewed by other people. For example, the attention levels may representthe average attention paid by the other users to each item. In anotherembodiment, the attention levels in the items are based on attentionlevels of the user to items in similar videos. For example, if the videodepicts a scene (e.g., a person filling out a loan application), then asimilar video may include the same scene, possibly with slightlydifferent items (e.g., a different person filling out a loanapplication).

In some embodiments, determining the expected attention levels in theitems may involve utilizing a model. Optionally, the model is trainedbased on previous tracking of the user's gaze when observing othervideos. Additionally or alternatively, the model is trained based ontracking of other users' gaze when observing other videos. Optionally,the model may be generated using one or more of the various attentionmodelling algorithms known in the art (such algorithms may also bereferred to as saliency mapping algorithms). Some of the many algorithmsthat may be utilized are surveyed in A. Borji, L. Itti,“State-of-the-Art in Visual Attention Modeling”, IEEE Transactions onPattern Analysis & Machine Intelligence vol. 35(1), p. 185-207, 2013.

In one embodiment, a model for attention in visual items may begenerated by creating a training set of samples. Where each samplecorresponds to an item in a video and includes features values and alabel describing the extent of attention in the item. Various featurevalues may be included in each sample. For example, some feature valuesmay be generated using various image processing techniques and representvarious low-level image properties. Some examples of such features mayinclude features generated using Gabor filters, local binary patternsand their derivatives, features generated using algorithms such as SIFT,SURF, and/or ORB, and features generated using PCA or LDA. In anotherexample, at least some feature values may include higher-leveldescription of the items (e.g., after identification of the items and/oractions depicted in the video). In yet another example, some featurevalues may describe the user viewing the video (e.g., demographicinformation about the user and/or data related to the user'sphysiological state). A collection of samples, such as the onesdescribed above, may be provided to a machine learning-based trainingalgorithm in order to train the model. Some examples of the types ofmodels that may be generated include support vector machines (SVMs) andneural networks.

Obtaining the expected attention levels may be done in various ways. Inone embodiment, values of the attention levels are determined based ontracking the gaze of the user (and/or other users) in previous viewingthe video and/or similar videos; the attention levels determined in thistracking may be used as the expected attention levels in the itemsdisplayed in the video while TH_(ROI) are taken. In another embodiment,feature values are generated based on the video and/or a description ofthe user, and the expected attention values are calculated based on thefeature values utilizing a model for attention in visual items, asdescribed above.

In one embodiment, the expected attention levels comprise values ofattention in two or more of the items. Additionally, the attention theuser paid to the two or more items is determined based on the gaze ofthe user. These two sets of values may be compared in order to calculatethe extent of the discordance between the attention the user paid to theitems and expected attention levels in the items. In one example, adivergence metric, such as the Kullback-Leibler divergence may be usedto calculate the discordance between the two sets of values. In anotherexample, a distance metric, such as a vector dot product may be used tocalculate the discordance between the two sets of values.

In another embodiment, the expected attention levels comprise anindication of a subset comprising one or more of the items to which theuser is expected to pay at least a certain amount of attention or one ormore of the items to which the user is expected to pay at most a certainamount of attention. Additionally, a subset of the items to which theuser paid at least the certain amount of attention (or at most thecertain amount of attention), is determined based on the gaze of theuser. In this embodiment, a comparison between the subset of itemsselected based on expected attention levels and the subset selectedbased on the gaze of the user may be done in order to calculate theextent of the discordance between the attention the user paid to theitems and expected attention levels in the items. In one example, theextent of the discordance is proportional to the size of the symmetricdifference between the two subsets.

In one embodiment, the stress level is calculated by comparing one ormore values derived from TH_(ROI) to a certain threshold, anddetermining whether the threshold is reached (which is indicative of anoccurrence of at least a certain amount of stress). Optionally, thecertain threshold is determined based on previous thermal measurementsof the user taken with CAM. Optionally, most of the previousmeasurements were taken while the user was not under elevated stress.Alternatively, most of the previous measurements were taken while theuser was under elevated stress. Optionally, the certain threshold isdetermined based on baseline thermal measurements of the user, and thecertain threshold represents a difference of a certain magnituderelative to the baseline measurements. Optionally, different thresholdsmay be utilized to detect the stress level when the user is in a certainemotional state and/or is in an environment characterized by certainenvironmental conditions.

In another embodiment, the stress level is calculated by generatingfeature values based on TH_(ROI) and utilizing a machine learning-basedmodel to calculate, based on the feature values, a stress levelexperienced by the user. Optionally, at least some of the feature valuesare generated based on the video, e.g., the at least some of the featurevalues describe properties of the items depicted in the video. In oneexample, the model is trained based on previous TH_(ROI) taken while theuser had at least two different stress levels according to apredetermined stress scale. In another example, the model is trainedbased on thermal measurements of other users (e.g., the model is ageneral model). Optionally, at least some of the feature values describethe emotional state of the user and/or environmental conditionscorresponding to when TH_(ROI) were taken. Optionally, at least some ofthe feature values are generated based on previous TH_(ROI) taken beforethe user viewed the video (e.g., up to 15 minutes before); thus, whendetermining the extent of stress the user experienced, the computer canaccount for the user's baseline stress level.

In some embodiments, at least some feature values utilized to calculatethe stress level may be based on thermal measurements obtained withother thermal cameras. In one embodiment, the ROI is on a periorbitalarea, and the system includes second and third CAMs configured to takethermal measurements of a region on the forehead (TH_(ROI2)) of the userand thermal measurements of a region on the nose (TH_(ROI3)) of theuser, respectively. Optionally, the computer detects the stress levelalso based on TH_(ROI2) and/or TH_(ROI3). In one example, the computergenerates feature values based on TH_(ROI) and on TH_(ROI2) and/orTH_(ROI3), and utilizes a certain model to calculate, based on thefeature values, the stress level of the user. In this example, thecertain model is trained based on previous TH_(ROI) and TH_(ROI2) and/orTH_(ROI3) taken while the user had at least two different stress levelsaccording to a predetermined stress scale.

There are various ways in which the computer may calculate, based on thestress level and the extent of discordance, a value indicative of aprobability that the items include an item that agitates the user.

In one embodiment, the value indicative of the probability is calculatedby comparing the stress level and the extent of discordance tocorresponding thresholds. For example, when the stress level reaches atleast a certain level and the discordance is at least a certain extent,that is indicative that there is at least a certain probability thatthat the items include an item that agitates the user. Optionally,calculating the probability involves utilizing a table that includesprobability values for different combinations of thresholds (i.e., fordifferent combinations of minimal stress levels and extents ofdiscordance). Optionally, the table is generated based on observationsof events in which the extent of stress of users was measured along withthe extent of discordance based on their gaze, along with indications ofwhether the events involved a video that includes an item that agitatedthe viewer.

In another embodiment, the computer generates feature values based onthe stress level and the extent of discordance and utilizes a machinelearning-based model to calculate, based on the feature values, theprobability that the items include an item that agitates the user. It isto be noted that this machine learning-based model is a different modelthan the one used in the embodiment described further above to detectthe stress level. Optionally, the feature values include at least somefeatures values indicative of the value of the stress level and/or theextent of discordance. Optionally, the feature values include at leastone feature value indicative of a difference between the stress leveland a baseline stress level of the user. Optionally, the feature valuesinclude at least one feature value that describes the video. Forexample, the at least one feature values may be indicative of what typesof items are presented in the video. Optionally, the feature valuesinclude at least one feature value describing the user (e.g., the atleast one feature value may be indicative of values such as the user's,the user's gender, the user's occupation, etc.) Optionally, the machinelearning-based model is trained based on samples generated from previousevents in which the extent of stress of users was measured along withthe extent of discordance based on their gaze, along with indications ofwhether the events involved a video that includes an item that agitatedthe viewer.

When utilizing feature values along with a machine learning-based model,such as the model used to detect the stress level or the model used tocalculate the value indicative of the probability that the items in thevideo include an item that agitates the user, in some embodiments, thefeature values may include values based on additional inputs. In oneexample, the computer (i) receives one or more values indicative of atleast one of the following parameters of the user: heart rate, heartrate variability, galvanic skin response, respiratory rate, andrespiratory rate variability, and (ii) generates one or more of thefeature values based on the one or more values. In another example, thecomputer (i) receives one or more values measured by at least one of thefollowing sensors coupled to the user: a photoplethysmogram (PPG)sensor, an electrocardiogram (ECG) sensor, an electroencephalography(EEG) sensor, a galvanic skin response (GSR) sensor, and a thermistor,and (ii) generates one or more of the feature values based on the one ormore values. In yet another example, the computer (i) receives one ormore values indicative of whether the user touched at least one of theeyes, whether the user is engaged in physical activity, and/or anenvironmental parameter, and (ii) generates one or more of the featurevalues based on the one or more values. In still another example, thecomputer (i) receives one or more values measured by an accelerometer, apedometer, a humidity sensor, a miniature radar, a miniature activeelectro-optics distance measurement device, an anemometer, an acousticsensor, and/or a light meter, and (ii) generates one or more of thefeature values based on the one or more values. And in another example,the computer (i) receives values indicative of at least one of thefollowing properties describing the user: age, gender, weight, height,health problems, mental health problems, occupation, education level,marital status, and (ii) generates one or more of the feature valuesbased on the one or more values.

FIG. 27 illustrates a scenario in which an embodiment of a systemdescribed above is utilized to identify that a user is agitated(stressed) from viewing a video. In this scenario, a user is measuredwith CAMs coupled to a frame worn on the user's head while viewing animage of an accident scene. Eye tracking reveals that the user isavoiding a region that corresponds to the accident and the thermalmeasurements indicate an elevated stress level. Thus, the system mayindicate that there is a high probability that the scene includessomething that particularly agitates the user.

In one embodiment, a system configured to identify whether a visualcontent includes an item that agitates a user, includes: an eye trackerconfigured to track the user's gaze while watching a visual contentdepicting items; where the user's gaze is indicative of attention theuser paid to the items; an inward-facing head-mounted thermal camera(CAM) configured to take thermal measurements of a region of interest onthe face (TH_(ROI)) of the user; and a computer configured to: calculatestress levels based on TH_(ROI), calculate an extent of discordancebetween the attention the user paid to the items and expected attentionlevels in the items, and determine, based on the stress level and theextent of discordance, whether at least one of the items agitated theuser.

The following is a description of steps involved in one embodiment of amethod for identifying when video includes an item that agitates a user.The steps described below may be performed by running a computer programhaving instructions for implementing the method. Optionally, theinstructions may be stored on a computer-readable medium, which mayoptionally be a non-transitory computer-readable medium. In response toexecution by a system including a processor and memory, the instructionscause the system to perform operations of the method. In one embodiment,the method includes at least the following steps:

In Step 1, tracking the user's gaze while the user watches a videodepicting items. Optionally, the user's gaze is indicative of attentionthe user paid to the items. Optionally, tracking the user's gaze isperformed by an eye tracker.

In Step 2, taking thermal measurements of a region of interest on theface (TH_(ROI)) of the user, while the user watches the video, with aninward-facing head-mounted thermal camera.

In Step 3, calculating stress levels based on TH_(ROI).

In Step 4, calculating an extent of discordance between the attentionthe user paid to the items and expected attention levels in the items.

And in Step 5, calculating, based on the stress level and the extent ofdiscordance, a value indicative of a probability that the items includean item that agitates the user.

In one embodiment, the method may optionally include a step involvingcalculating the expected attention levels in the items utilizing a modelof the user. Optionally, the model used in this step was trained basedon previous tracking of the user's gaze when observing other videos.Additionally or alternatively, calculating the expected attention levelsin the items using a saliency mapping algorithm.

In another embodiment, the method may optionally include a stepinvolving calculating, based on TH_(ROI), stress levels corresponding todifferent times, and utilizing tracking of the user's gaze to assignstress levels to different items.

In yet another embodiment, the method may optionally include a stepinvolving identifying that an item from among the items is a suspiciousitem based on the stress level reaching a first threshold and adifference between the attention the user paid to the item and theexpected attention to the item reaching a second threshold.

Some aspects of this disclosure involve monitoring a user whileperforming his or her job in order to create a model of the user'stypical behavior. This monitoring may involve determining the typicalstress levels of the user and gaze patterns (e.g., what the usertypically pays attention too when performing the usual activities on thejob). When the user exhibits atypical behavior while performing a job,it may be an indication that something illicit and/or illegal is beingperformed. For example, a bank loan officer knowingly approving a faultyloan may exhibit higher stress levels while evaluating the loan formsand may also have a significantly different gaze pattern compared towhen working on a usual loan application. In another example, a doctorexamining a patient in order to assist in a faulty insurance claim mayalso be more stressed and/or have a different gaze pattern. In yetanother example, a customs official “looking the other way” when anaccomplice smuggles contraband is also expected to have elevated stresslevels and a different gaze pattern than ordinarily observed on the job.When atypical behavior is detected, it can be noted in order to have theevent to which it corresponds inspected more thoroughly by other parties(e.g., a supervisor).

FIG. 28a and FIG. 28b illustrate a scenario in which stress levels andgaze patterns may be utilized do detect atypical user behavior. FIG. 28aillustrates a typical gaze pattern of the user shown as dashed-lineclosed-shapes on screen 631 (obtained using eye tracking), while theuser performs his job at a computer terminal. Thermal measurements ofthe user 630 indicate that the user is not stressed. FIG. 28billustrates an instance in which the user has an atypical gaze patternshown as dashed-line closed-shapes on screen 633, and in addition, thethermal measurements of the user 632 indicate that the user is stressed.Embodiments of the system described below can identify the atypical gazepattern and the user elevated stress level, and generate an indicationthat the user is behaving atypically.

In one embodiment, a system configured to identify atypical behavior ofa user includes an eye tracker, a CAM, and a computer. CAM takes thermalmeasurements of a region of interest (TH_(ROI)) on the user's face.Optionally, CAM is located less than 15 cm from the face. Optionally,the ROI is on a periorbital area. Optionally, the system also includes ahead-mounted display (HMD), which displays video to the user. The systemmay optionally include a frame which is worn on the user's head, and oneor more of the following components are physically coupled to the frame:the HMD, CAM, the eye tracker, and the computer.

The eye tracker tracks the user's gaze while viewing items. Optionally,the user's gaze is indicative of attention of the user in the items.Optionally, the user's gaze is indicative of attention the user paid toeach of the items. In one embodiment, the user's gaze is tracked whilethe user performs some work related task, such as performing office work(e.g., if the user is a clerk) or examining a patient (e.g., if the useris a doctor). Optionally, the user's gaze is tracked while the userviews video related to the task the user is performing. In one example,the video is presented via the HMD, which may be a virtual realitydisplay or an augmented reality display.

In some embodiments, the computer generates features values and utilizesa model to identify, based on the feature values, whether the user'sbehavior while viewing the items was atypical. Optionally, the featurevalues include feature values generated based on TH_(ROI) taken whilethe user viewed the items and a set of feature values generated based ontracking the user's gaze. Optionally, the feature values generated basedon the eye tracking are indicative of the attention of the user in theitems. Optionally, the feature values may include at least some featurevalues indicative of expected attention levels in the items.

In one embodiment, the system configured to identify atypical behaviorincludes a second inward-facing head-mounted thermal camera that takesmeasurements of a second region on the face (TH_(ROI2)). Optionally, thecomputer generates one or more of the feature values used to detect theatypical behavior based on TH_(ROI2). In one example, the second regionis on the forehead. In another example, the second region is on thenose.

In another embodiment, the computer generates one or more of the featurevalues based on a difference between TH_(ROI) and a baseline valuedetermined based on a set of previous measurements taken by CAM.Optionally, most of the measurements belonging to the set were takenwhile the behavior of the user was not considered atypical according tothe model.

In one embodiment, the model used to identify whether the user'sbehavior was atypical is generated based on previous tracking of theuser's gaze while viewing other items and previous TH_(ROI) taken duringthe viewing of the other items. Optionally, the user's behavior duringmost of the viewing of the other items was typical (i.e., it was notconsidered atypical). Optionally, the viewing of the previous items wasdone while the user was performing a similar activity to one performedby the user while TH_(ROI) were taken. Optionally, the previous TH_(ROI)were taken on different days. Optionally, the previous TH_(ROI) weretaken in different situations that include first TH_(ROI) taken at mostone hour before having a meal and second TH_(ROI) taken at most one hourafter having a meal. Optionally, the model is trained based on trainingsamples, with each training sample corresponding to an event in whichthe user was monitored with the eye tracker and CAM, and each trainingsample comprising feature values generated based on a tracking of theuser's gaze and TH_(ROI) taken during the event.

In one embodiment, the model is indicative of a probability densityfunction (pdf) of values derived from TH_(ROI) and/or values derivedfrom tracking the gaze of the user. For example, the model may be aregression model (e.g., a maximum entropy model) generated based on thetraining samples described above. Optionally, if the value calculated bythe computer represents a probability that is below a threshold, thebehavior of the user is considered atypical.

In another embodiment, the model describes one or more thresholdsderived from TH_(ROI) and/or values derived from tracking the gaze ofthe user. For example, the model may include typical ranges forTH_(ROI), which are indicative of typical stress levels, and/or typicalgaze patterns of the user, which are indicative of how much attentionthe user pays to different items. Optionally, if the user exhibitsbehavior that does not correspond to values in the ranges that appear inthe model, that is indicative that the user's behavior while viewing theitems was atypical.

The computer may calculate, based on TH_(ROI) a value describing astress level of the user. Additionally or alternatively, the computermay calculate an extent of discordance between the attention the userpaid to the items and expected attention levels in the items.Optionally, the stress level and/or the extent of discordance areutilized by the computer to identify whether the user's behavior whileviewing the items was atypical. For example, one or more of the featurevalues may be generated based on the stress level and/or one or more ofthe feature values may be generated based on the extent of thediscordance.

In some embodiments, when the user's behavior while viewing the itemswas atypical, a stress level of the user during the viewing, which iscalculated based on TH_(ROI), reaches a threshold. The stress levels ofthe user during most of the time spent viewing the other items, ascalculated based on the previous TH_(ROI), do not reach the threshold.As discussed in more detail further above, there are various ways inwhich the computer may detect the stress level based on TH_(ROI). In oneembodiment, the stress level is calculated by comparing one or morevalues derived from TH_(ROI) to a certain threshold, and determiningwhether the threshold is reached (which is indicative of an occurrenceof at least a certain amount of stress). Optionally, the certainthreshold is determined based on thermal measurements of the user (e.g.,thermal measurements taken when the user was stressed). In anotherembodiment, the stress level is calculated by generating certain featurevalues based on TH_(ROI) and utilizing a certain machine learning-basedmodel to calculate, based on the certain feature values, the stresslevel experienced by the user.

In some embodiments, when the user's behavior while viewing the itemswas atypical, a divergence between the attention of the user in theitems and expected attention of the user in the items is above a certainvalue. During most of the time spent viewing of the other items,divergences between the attention of the user in the other items andexpected attention of the user in the other items were below thethreshold. As discussed in more detail above, expected attention levelsmay be obtained in various ways. In one example, the expected attentionlevels in the other items are calculated utilizing a certain model ofthe user, which is trained based on previous tracking of the user'sgaze. In another example, the expected attention levels in the otheritems are calculated utilizing a certain model that is trained based ontracking of other users' gaze. In yet another example, the expectedattention levels in the other items are calculated using a saliencymapping algorithm.

When utilizing feature values along with a model, such as the certainmodel used to detect the stress level and/or the model used to identifywhether the user's behavior was atypical, in some embodiments, thefeature values may include values based on additional inputs (beyondTH_(ROI)), which are also utilized to detect the stress level. In oneexample, the computer (i) receives one or more values indicative of atleast one of the following parameters of the user: heart rate, heartrate variability, galvanic skin response, respiratory rate, andrespiratory rate variability, and (ii) generates one or more of thefeature values based on the one or more values. In another example, thecomputer (i) receives one or more values measured by at least one of thefollowing sensors coupled to the user: a photoplethysmogram (PPG)sensor, an electrocardiogram (ECG) sensor, an electroencephalography(EEG) sensor, a galvanic skin response (GSR) sensor, and a thermistor,and (ii) generates one or more of the feature values based on the one ormore values. In yet another example, the computer (i) receives one ormore values indicative of whether the user touched at least one of theeyes, whether the user is engaged in physical activity, and/or anenvironmental parameter, and (ii) generates one or more of the featurevalues based on the one or more values. In still another example, thecomputer (i) receives one or more values measured by an accelerometer, apedometer, a humidity sensor, a miniature radar, a miniature activeelectro-optics distance measurement device, an anemometer, an acousticsensor, and/or a light meter, and (ii) generates one or more of thefeature values based on the one or more values. And in another example,the computer (i) receives values indicative of at least one of thefollowing properties describing the user: age, gender, weight, height,health problems, mental health problems, occupation, education level,marital status, and (ii) generates one or more of the feature valuesbased on the one or more values.

The following is a description of steps involved in one embodiment of amethod for identifying atypical behavior. The steps described below maybe performed by running a computer program having instructions forimplementing the method. Optionally, the instructions may be stored on acomputer-readable medium, which may optionally be a non-transitorycomputer-readable medium. In response to execution by a system includinga processor and memory, the instructions cause the system to performoperations of the method. In one embodiment, the method includes atleast the following steps:

In Step 1, tracking the user's gaze while the user views items.Optionally, the user's gaze is indicative of attention the user paid tothe items. Optionally, tracking the user's gaze is performed by the eyetracker described above.

In Step 2, taking thermal measurements of a region of interest(TH_(ROI)) on the user's face, while the user views the items, with aninward-facing head-mounted thermal camera.

In Step 3, generating feature values. Optionally, the generated featurevalues include feature values generated based on TH_(ROI) and featurevalues based on the tracking in Step 1.

And in Step 4, utilizing a model to identify, based on the featurevalues generated in Step 3, whether the user's behavior, while viewingthe items, was atypical. Optionally, the model was trained based onprevious tracking of the user's gaze while viewing other items andprevious TH_(ROI) taken during the viewing of the other items.

In one embodiment, the method may optionally involve a step ofcalculating expected attention of the user in the items and generatingat least some of the feature values based on the expected attention ofthe user in the items. Optionally, the user's gaze is indicative ofattention of the user in the items, and when the user's behavior whileviewing the items is atypical, a divergence between the attention of theuser in the items and the expected attention of the user in the items isabove a certain value.

In one embodiment, the method may optionally include steps that involve:taking, using a second inward-facing head-mounted thermal camera,additional thermal measurements of a region on the forehead, andgenerating one or more of the feature values used in Step 4, based onthe additional thermal measurements.

In another embodiment, the method may optionally include steps thatinvolve: taking, using a second inward-facing head-mounted thermalcamera, additional thermal measurements of a region on the nose, andgenerating one or more of the feature values used in Step 4, based onthe additional thermal measurements.

Normally, the lens plane and the sensor plane of a camera are parallel,and the plane of focus (PoF) is parallel to the lens and sensor planes.If a planar object is also parallel to the sensor plane, it can coincidewith the PoF, and the entire object can be captured sharply. If the lensplane is tilted (not parallel) relative to the sensor plane, it will bein focus along a line where it intersects the PoF. The Scheimpflugprinciple is a known geometric rule that describes the orientation ofthe plane of focus of a camera when the lens plane is tilted relative tothe sensor plane.

FIG. 14a is a schematic illustration of an inward-facing head-mountedcamera 550 embedded in an eyeglasses frame 551, which utilizes theScheimpflug principle to improve the sharpness of the image taken by thecamera 550. The camera 550 includes a sensor 558 and a lens 555. Thetilt of the lens 555 relative to sensor 558, which may also beconsidered as the angle between the lens plane 555 and the sensor plane559, is determined according to the expected position of the camera 550relative to the ROI 552 when the user wears the eyeglasses. For arefractive optical lens, the “lens plane” 556 refers to a plane that isperpendicular to the optical axis of the lens 555. Herein, the singularalso includes the plural, and the term “lens” refers to one or morelenses. When “lens” refers to multiple lenses (which is usually the casein most modern cameras having a lens module with multiple lenses), thenthe “lens plane” refers to a plane that is perpendicular to the opticalaxis of the lens module.

The Scheimpflug principle may be used for both thermal cameras (based onlenses and sensors for wavelengths longer than 2500 nm) andvisible-light and/or near-IR cameras (based on lenses and sensors forwavelengths between 400-900 nm). FIG. 14b is a schematic illustration ofa camera that is able to change the relative tilt between its lens andsensor planes according to the Scheimpflug principle. Housing 311 mountsa sensor 312 and lens 313. The lens 313 is tilted relative to the sensor312. The tilt may be fixed according to the expected position of thecamera relative to the ROI when the user wears the HMS, or may beadjusted using motor 314. The motor 314 may move the lens 313 and/or thesensor 312.

In one embodiment, the tilt between the lens plane and sensor plane isfixed. The fixed tilt is selected according to an expected orientationbetween the camera and the ROI when a user wears the frame. Having afixed tilt between the lens and sensor planes may eliminate the need foran adjustable electromechanical tilting mechanism. As a result, a fixedtilt may reduce the weight and cost of the camera, while still providinga sharper image than an image that would be obtained from a similarcamera in which the lens and sensor planes are parallel. The magnitudeof the fixed tilt may be selected according to facial dimensions of anaverage user expected to wear the system, or according to a model of thespecific user expected to wear the system in order to obtain thesharpest image.

Various embodiments described herein involve an HMS that may beconnected, using wires and/or wirelessly, with a device carried by theuser and/or a non-wearable device. The HMS may include a battery, acomputer, sensors, and a transceiver.

FIG. 29a and FIG. 29b are schematic illustrations of possibleembodiments for computers (400, 410) that are able to realize one ormore of the embodiments discussed herein that include a “computer”. Thecomputer (400, 410) may be implemented in various ways, such as, but notlimited to, a server, a client, a personal computer, a network device, ahandheld device (e.g., a smartphone), an HMS (such as smart glasses, anaugmented reality system, and/or a virtual reality system), a computingdevice embedded in a wearable device (e.g., a smartwatch or a computerembedded in clothing), a computing device implanted in the human body,and/or any other computer form capable of executing a set of computerinstructions. Herein, an augmented reality system refers also to a mixedreality system. Further, references to a computer or processor includeany collection of one or more computers and/or processors (which may beat different locations) that individually or jointly execute one or moresets of computer instructions. For example, a first computer may beembedded in the HMS that communicates with a second computer embedded inthe user's smartphone that communicates over the Internet with a cloudcomputer.

The computer 400 includes one or more of the following components:processor 401, memory 402, computer readable medium 403, user interface404, communication interface 405, and bus 406. The computer 410 includesone or more of the following components: processor 411, memory 412, andcommunication interface 413.

Thermal measurements that are forwarded to a processor/computer mayinclude “raw” values that are essentially the same as the valuesmeasured by thermal cameras, and/or processed values that are the resultof applying some form of preprocessing and/or analysis to the rawvalues. Examples of methods that may be used to process the raw valuesinclude analog signal processing, digital signal processing, and variousforms of normalization, noise cancellation, and/or feature extraction.

Functionality of various embodiments may be implemented in hardware,software, firmware, or any combination thereof. If implemented at leastin part in software, implementing the functionality may involve acomputer program that includes one or more instructions or code storedor transmitted on a computer-readable medium and executed by one or moreprocessors. Computer-readable media may include computer-readablestorage media, which corresponds to a tangible medium such as datastorage media, or communication media including any medium thatfacilitates transfer of a computer program from one place to another.Computer-readable medium may be any media that can be accessed by one ormore computers to retrieve instructions, code, data, and/or datastructures for implementation of the described embodiments. A computerprogram product may include a computer-readable medium. In one example,the computer-readable medium 403 may include one or more of thefollowing: RAM, ROM, EEPROM, optical storage, magnetic storage, biologicstorage, flash memory, or any other medium that can store computerreadable data.

A computer program (also known as a program, software, softwareapplication, script, program code, or code) can be written in any formof programming language, including compiled or interpreted languages,declarative or procedural languages. The program can be deployed in anyform, including as a standalone program or as a module, component,subroutine, object, or another unit suitable for use in a computingenvironment. A computer program may correspond to a file in a filesystem, may be stored in a portion of a file that holds other programsor data, and/or may be stored in one or more files that may be dedicatedto the program. A computer program may be deployed to be executed on oneor more computers that are located at one or more sites that may beinterconnected by a communication network.

Computer-readable medium may include a single medium and/or multiplemedia (e.g., a centralized or distributed database, and/or associatedcaches and servers) that store one or more sets of instructions. Invarious embodiments, a computer program, and/or portions of a computerprogram, may be stored on a non-transitory computer-readable medium, andmay be updated and/or downloaded via a communication network, such asthe Internet. Optionally, the computer program may be downloaded from acentral repository, such as Apple App Store and/or Google Play.Optionally, the computer program may be downloaded from a repository,such as an open source and/or community run repository (e.g., GitHub).

At least some of the methods described herein are “computer-implementedmethods” that are implemented on a computer, such as the computer (400,410), by executing instructions on the processor (401, 411).Additionally, at least some of these instructions may be stored on anon-transitory computer-readable medium.

Herein, a direction of the optical axis of a VCAM or a CAM that hasfocusing optics is determined by the focusing optics, while thedirection of the optical axis of a CAM without focusing optics (such asa single pixel thermopile) is determined by the angle of maximumresponsivity of its sensor. When optics are utilized to takemeasurements with a CAM, then the term CAM includes the optics (e.g.,one or more lenses). In some embodiments, the optics of a CAM mayinclude one or more lenses made of a material suitable for the requiredwavelength, such as one or more of the following materials: CalciumFluoride, Gallium Arsenide, Germanium, Potassium Bromide, Sapphire,Silicon, Sodium Chloride, and Zinc Sulfide. In other embodiments, theCAM optics may include one or more diffractive optical elements, and/oror a combination of one or more diffractive optical elements and one ormore refractive optical elements.

When CAM includes an optical limiter/field limiter/FOV limiter (such asa thermopile sensor inside a standard TO-39 package with a window, or athermopile sensor with a polished metal field limiter), then the termCAM may also refer to the optical limiter. Depending on the context, theterm CAM may also refer to a readout circuit adjacent to CAM, and/or tothe housing that holds CAM.

Herein, references to thermal measurements in the context of calculatingvalues based on thermal measurements, generating feature values based onthermal measurements, or comparison of thermal measurements, relate tothe values of the thermal measurements (which are values of temperatureor values of temperature changes). Thus, a sentence in the form of“calculating based on TH_(ROI)” may be interpreted as “calculating basedon the values of TH_(ROI)”, and a sentence in the form of “comparingTH_(ROI1) and TH_(ROI2)” may be interpreted as “comparing values ofTH_(ROI1) and values of TH_(ROI2)”.

Depending on the embodiment, thermal measurements of an ROI (usuallydenoted TH_(ROI) or using a similar notation) may have various forms,such as time series, measurements taken according to a varying samplingfrequency, and/or measurements taken at irregular intervals. In someembodiments, thermal measurements may include various statistics of thetemperature measurements (T) and/or the changes to temperaturemeasurements (ΔT), such as minimum, maximum, and/or average values.Thermal measurements may be raw and/or processed values. When a thermalcamera has multiple sensing elements (pixels), the thermal measurementsmay include values corresponding to each of the pixels, and/or includevalues representing processing of the values of the pixels. The thermalmeasurements may be normalized, such as normalized with respect to abaseline (which is based on earlier thermal measurements), time of day,day in the month, type of activity being conducted by the user, and/orvarious environmental parameters (e.g., the environment's temperature,humidity, radiation level, etc.).

As used herein, references to “one embodiment” (and its variations) meanthat the feature being referred to may be included in at least oneembodiment of the invention. Moreover, separate references to “oneembodiment”, “some embodiments”, “another embodiment”, “still anotherembodiment”, etc., may refer to the same embodiment, may illustratedifferent aspects of an embodiment, and/or may refer to differentembodiments.

Some embodiments may be described using the verb “indicating”, theadjective “indicative”, and/or using variations thereof. Herein,sentences in the form of “X is indicative of Y” mean that X includesinformation correlated with Y, up to the case where X equals Y. Forexample, sentences in the form of “thermal measurements indicative of aphysiological response” mean that the thermal measurements includeinformation from which it is possible to infer the physiologicalresponse. Stating that “X indicates Y” or “X indicating Y” may beinterpreted as “X being indicative of Y”. Additionally, sentences in theform of “provide/receive an indication indicating whether X happened”may refer herein to any indication method, including but not limited to:sending/receiving a signal when X happened and not sending/receiving asignal when X did not happen, not sending/receiving a signal when Xhappened and sending/receiving a signal when X did not happen, and/orsending/receiving a first signal when X happened and sending/receiving asecond signal X did not happen.

Herein, “most” of something is defined as above 51% of the something(including 100% of the something). Both a “portion” of something and a“region” of something refer herein to a value between a fraction of thesomething and 100% of the something. For example, sentences in the formof a “portion of an area” may cover between 0.1% and 100% of the area.As another example, sentences in the form of a “region on the user'sforehead” may cover between the smallest area captured by a single pixel(such as 0.1% or 5% of the forehead) and 100% of the forehead. The word“region” refers to an open-ended claim language, and a camera said tocapture a specific region on the face may capture just a small part ofthe specific region, the entire specific region, and/or a portion of thespecific region together with additional region(s).

Sentences in the form of “angle greater than 20°” refer to absolutevalues (which may be +20° or −20° in this example), unless specificallyindicated, such as in a phrase having the form of “the optical axis ofCAM is 20° above/below the Frankfort horizontal plane” where it isclearly indicated that the CAM is pointed upwards/downwards. TheFrankfort horizontal plane is created by two lines from the superioraspects of the right/left external auditory canal to the most inferiorpoint of the right/left orbital rims.

The terms “comprises,” “comprising,” “includes,” “including,” “has,”“having”, or any other variation thereof, indicate an open-ended claimlanguage that does not exclude additional limitations. The “a” or “an”is employed to describe one or more, and the singular also includes theplural unless it is obvious that it is meant otherwise; for example,sentences in the form of “a CAM configured to take thermal measurementsof a region (TH_(ROI))” refers to one or more CAMs that take thermalmeasurements of one or more regions, including one CAM that takesthermal measurements of multiple regions; as another example, “acomputer” refers to one or more computers, such as a combination of awearable computer that operates together with a cloud computer.

The phrase “based on” is intended to mean “based, at least in part, on”.Additionally, stating that a value is calculated “based on X” andfollowing that, in a certain embodiment, that the value is calculated“also based on Y”, means that in the certain embodiment, the value iscalculated based on X and Y.

The terms “first”, “second” and so forth are to be interpreted merely asordinal designations, and shall not be limited in themselves. Apredetermined value is a fixed value and/or a value determined any timebefore performing a calculation that compares a certain value with thepredetermined value. A value is also considered to be a predeterminedvalue when the logic, used to determine whether a threshold thatutilizes the value is reached, is known before start performingcomputations to determine whether the threshold is reached.

The embodiments of the invention may include any variety of combinationsand/or integrations of the features of the embodiments described herein.Although some embodiments may depict serial operations, the embodimentsmay perform certain operations in parallel and/or in different ordersfrom those depicted. Moreover, the use of repeated reference numeralsand/or letters in the text and/or drawings is for the purpose ofsimplicity and clarity and does not in itself dictate a relationshipbetween the various embodiments and/or configurations discussed. Theembodiments are not limited in their applications to the order of stepsof the methods, or to details of implementation of the devices, set inthe description, drawings, or examples. Moreover, individual blocksillustrated in the figures may be functional in nature and therefore maynot necessarily correspond to discrete hardware elements.

Certain features of the embodiments, which may have been, for clarity,described in the context of separate embodiments, may also be providedin various combinations in a single embodiment. Conversely, variousfeatures of the embodiments, which may have been, for brevity, describedin the context of a single embodiment, may also be provided separatelyor in any suitable sub-combination. Embodiments described in conjunctionwith specific examples are presented by way of example, and notlimitation. Moreover, it is evident that many alternatives,modifications, and variations will be apparent to those skilled in theart. It is to be understood that other embodiments may be utilized andstructural changes may be made without departing from the scope of theembodiments. Accordingly, this disclosure is intended to embrace allsuch alternatives, modifications, and variations that fall within thespirit and scope of the appended claims and their equivalents.

We claim:
 1. A system configured to identify atypical behavior,comprising: an eye tracker configured to perform tracking of a user'sgaze while viewing items; an inward-facing head-mounted thermal camera(CAM) configured to take thermal measurements of a region of interest onthe face (TH_(ROI)) of the user; and a computer configured to: generatefeature values based on TH_(ROI) and the tracking; and utilize a machinelearning-based model to identify atypical behavior of the user based onthe feature values; wherein the machine learning-based model was trainedbased on previous tracking and previous TH_(ROI) of the user, takenwhile viewing other items.
 2. The system of claim 1, further comprisinga frame configured to be worn on a user's head; wherein the eye trackerand CAM are coupled to the frame, the region of interest is on aperiorbital area of the face, and CAM is located less than 15 cm fromthe face.
 3. The system of claim 2, further comprising a secondinward-facing head-mounted thermal camera configured to take thermalmeasurements of a region on the forehead (TH_(ROI2)); and wherein thecomputer is further configured to generate one or more of the featurevalues also based on TH_(ROI2).
 4. The system of claim 2, furthercomprising a second inward-facing head-mounted thermal camera configuredto take thermal measurements of a region on the nose (TH_(ROI2)); andwherein the computer is further configured to generate one or more ofthe feature values also based on TH_(ROI2).
 5. The system of claim 1,wherein the user's behavior during most of the viewing of the otheritems was typical, and the previous TH_(ROI) were taken during differentdays and in different situations that include first TH_(ROI) taken atmost one hour before having a meal and second TH_(ROI) taken at most onehour after having a meal.
 6. The system of claim 1, wherein when theuser's behavior while viewing the items is atypical, a stress level ofthe user during the viewing, which is calculated based on TH_(ROI),reaches a threshold; and wherein stress levels of the user during mostof the time spent viewing the other items, as calculated based on theprevious TH_(ROI), do not reach the threshold.
 7. The system of claim 1,wherein the user's gaze is indicative of attention of the user in theitems.
 8. The system of claim 7, wherein the computer is furtherconfigured to generate additional feature values indicative of expectedattention of the user in the items and to utilize the additional featurevalues to identify the atypical behavior; wherein when the user'sbehavior while viewing the items is atypical, a divergence between theattention of the user in the items and the expected attention of theuser in the items is above a certain value; and wherein during most ofthe time spent while viewing the other items, divergences betweenattention of the user in the other items and expected attention levelsin the other items were not above the certain value.
 9. The system ofclaim 8, wherein the expected attention levels in the other items arecalculated utilizing a certain model of the user; and wherein thecertain model was trained based on previous tracking of the user's gaze.10. The system of claim 8, wherein the expected attention levels in theother items are calculated utilizing a certain model; and wherein thecertain model was trained based on tracking of other users' gaze. 11.The system of claim 8, wherein the expected attention levels in theother items are calculated using a saliency mapping algorithm.
 12. Thesystem of claim 1, wherein the computer is further configured togenerate one or more of the feature values based on a difference betweenTH_(ROI) and a baseline value determined based on a set of previousmeasurements taken by CAM; and wherein most of the measurementsbelonging to the set were taken while the user's behavior was notconsidered atypical according to the machine learning-based model. 13.The system of claim 1, further comprising a head-mounted display (HMD)configured to expose the user to video depicting the items; and whereinthe computer is further configured to: (i) receive one or more valuesindicative of at least one of the following parameters of the user:heart rate, heart rate variability, galvanic skin response, respiratoryrate, and respiratory rate variability, and (ii) to generate some of thefeature values based on the one or more values.
 14. The system of claim1, wherein the computer is further configured to: (i) receive one ormore values measured by at least one of the following sensors coupled tothe user: a photoplethysmogram (PPG) sensor, an electrocardiogram (ECG)sensor, an electroencephalography (EEG) sensor, a galvanic skin response(GSR) sensor, and a thermistor, and (ii) to generate some of the featurevalues based on the one or more values.
 15. The system of claim 1,wherein the computer is further configured to: (i) receive one or morevalues indicative of at least one of the following: whether the usertouched at least one of the eyes, and whether the user is engaged inphysical activity, and (ii) to generate some of the feature values basedon the one or more values.
 16. The system of claim 1, wherein thecomputer is further configured to: (i) receive one or more valuesmeasured by at least one of the following sensors: an accelerometer, apedometer, a humidity sensor, a miniature radar, a miniature activeelectro-optics distance measurement device, an anemometer, an acousticsensor, and a light meter, and (ii) to generate some of the featurevalues based on the one or more values.
 17. A method for identifyingatypical behavior, comprising: tracking a user's gaze while viewingitems; taking, using an inward-facing head-mounted thermal camera,thermal measurements of a region of interest on the face (TH_(ROI)) of auser; generating feature values based on TH_(ROI) and the tracking; andutilizing a machine learning-based model to identify, based on thefeature values, atypical behavior of the user; wherein the machinelearning-based model was trained based on previous tracking and previousTH_(ROI) of the user, taken while viewing other items.
 18. The method ofclaim 17, further comprising calculating expected attention of the userin the items and generating at least some of the feature values based onthe expected attention of the user in the items; wherein the user's gazeis indicative of attention of the user in the items, and when the user'sbehavior while viewing the items is atypical, a divergence between theattention of the user in the items and the expected attention of theuser in the items is above a certain value.
 19. The method of claim 17,wherein the region of interest is on a periorbital area of the face, andfurther comprising taking, using a second inward-facing head-mountedthermal camera, thermal measurements of a region on the forehead(TH_(ROI2)); and generating one or more of the feature values also basedon TH_(ROI2).
 20. The method of claim 17, wherein the region of interestis on a periorbital area of the face, and further comprising taking,using a second inward-facing head-mounted thermal camera, thermalmeasurements of a region on the nose (TH_(ROI2)); and generating one ormore of the feature values also based on TH_(ROI2).